CVE-2018-11623

CVE-2018-11623 affects Foxit Reader 9.0.1.1049 where the vulnerability is in the addAdLayer method, causing a type-confusion condition that allows remote code execution when a user visits a malicious page or opens a malicious file, with user interaction required. The issue is documented in ZDI-18...

CVE-2018-14250

CVE-2018-14250 affects Foxit Reader (and Foxit PhantomPDF) with a getAnnot type-confusion vulnerability that allows remote code execution. Root cause: type confusion in getAnnot triggered by JavaScript actions, requiring user interaction (visiting a malicious page or opening a malicious file). Ex...

CVE-2018-14249

CVE-2018-14249 is a type-confusion remote code execution in Foxit Reader’s exportDataObject method. Affected product: Foxit Reader (9.0.1.1049) with exploitation requiring user interaction (malicious page or file) via JavaScript to trigger the flaw. Documents also reference a broader set of relat...

CVE-2018-14251

Foxit Reader CVE-2018-14251 is a type-confusion remote code execution affecting Foxit Reader 9.0.1.1049. The flaw occurs in getDataObject and can be triggered via actions in JavaScript after the user visits a malicious page or opens a malicious file, enabling code execution in the current process...

CVE-2018-14307

CVE-2018-14307 affects Foxit Reader (e.g., 9.0.1.5096; CNVD lists 9.1.0.5096 and earlier) due to a use-after-free in the processing of Link objects, enabling remote code execution after user opens a malicious page/file. Exploitation requires user interaction. Related advisories (ZDI-18-767; OpenV...

CVE-2018-14262

CVE-2018-14262 affects Foxit Reader (example affected build: 9.0.1.1049). The root cause is a type confusion in the getURL method that can be triggered through JavaScript actions, allowing remote code execution with the attacker’s code running in the current process context. User interaction is r...

CVE-2018-14269

The CVE-2018-14269 issue is a type confusion vulnerability in Foxit Reader’s print method that allows remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file) and JavaScript actions trigger the fault, executing code in the current proce...

CVE-2018-14268

Foxit Reader CVE-2018-14268 is a type-confusion remote code execution in the mailForm method of Foxit Reader (9.0.1.1049 and earlier). Exploitation requires user interaction (visiting a malicious page or opening a crafted file). The flaw enables code execution under the current process context an...

CVE-2018-14285

CVE-2018-14285 affects Foxit Reader 9.0.1.1049 (Windows) and is caused by improper validation in handling of the oneOfChild attribute, leading to a type confusion condition that allows remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious ...

CVE-2018-14274

CVE-2018-14274 affects Foxit Reader (notably 9.0.1.1049 in the NVD entry). The flaw is a type confusion in the scroll method that can be triggered via JavaScript actions, enabling remote code execution under the current process when a user visits a malicious page or opens a malicious file. Multip...

CVE-2018-14308

CVE-2018-14308 affects Foxit Reader (and Foxit PhantomPDF) with versions before 9.2.0.9097. The root cause is a use-after-free in valueAsString handling where the code does not verify an object exists before operating on it, allowing remote code execution when a user visits a malicious page or op...

CVE-2018-14292

CVE-2018-14292 affects Foxit Reader (e.g., 9.0.1.5096 and older) where a vulnerability in PDF parsing can cause a use-after-free in document element handling, enabling remote code execution in the current process. Exploitation requires user interaction (target must open a malicious page or file)....

CVE-2018-14289

CVE-2018-14289 affects Foxit Reader, including version 9.0.1.5096, with an out-of-bounds read in PDF document parsing that can disclose sensitive information. The vulnerability requires user interaction (visiting a malicious page or opening a malicious file) and can be leveraged with other issues...

CVE-2018-14314

CVE-2018-14314 affects Foxit Reader 9.0.1.5096. The flaw is in the handling of annotations where the software fails to validate the existence of an object before operating on it, allowing remote attackers to execute arbitrary code in the current process. Exploitation requires user interaction (vi...

CVE-2018-14278

CVE-2018-14278 affects Foxit Reader. The flaw is a type confusion in getPageNumWords that can allow remote code execution via crafted JavaScript when a user opens a malicious page/file. Exploitation requires user interaction. Reports/connected advisories indicate multiple related fixes; remediati...

CVE-2018-14281

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14257

CVE-2018-14257 is a Foxit Reader remote code execution vulnerability in the getPageBox method that enables code execution via crafted JavaScript when a user visits a malicious page or opens a malicious file. The issue is a type confusion condition triggered by actions in JavaScript, allowing an a...

CVE-2018-14302

CVE-2018-14302 affects Foxit Reader (Windows) via a remote code execution vulnerability in Square annotations. The flaw is an use-after-free in processing of annotations that can be triggered when a user visits a malicious page or opens a malicious file, enabling arbitrary code execution in the c...

CVE-2018-14250

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14295

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF Phantom PDF 9.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...