PT-2019-9814

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK ActiveX Professional version 5.4.0.1031 Description The issue arises from an uninitialized object in the IReader ContentProvider::GetDocEventHandler function when the control is embedded into Office documents. This can be...

PT-2019-9813

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK ActiveX version 5.4.0.1031 Description A stack-based buffer overflow issue exists when parsing specially crafted PDF files, potentially allowing an attacker to gain remote code execution. Recommendations For Foxit Reader SDK...

CVE-2018-19445: Improper Neutralization of Special Elements used in a Command

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API app.launchURL is used. An attacker can leverage this to gain remote code execution...

CVE-2018-19446: Incorrect Permission Assignment for Critical Resource

A File Write can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API Doc.createDataObject is used. An attacker can leverage this to gain remote code execution...

CVE-2018-19447: Out-of-bounds Write

A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK ActiveX 5.4.0.1031 when parsing the URI string. An attacker can leverage this to gain remote code execution...

CVE-2018-19444: Use After Free

A use after free in the TextBox field Validate action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19452, this has a different free locatio...

CVE-2018-19449: Out-of-bounds Write

A File Write can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API Doc.exportAsFDF is used. An attacker can leverage this to gain remote code execution...

PT-2019-9811

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK ActiveX Professional version 5.4.0.1031 Description A command injection issue can occur when processing specially crafted PDF files, allowing an attacker to potentially gain remote code execution. This issue is related to the...

Remote code execution

A use after free in the TextBox field Mouse Enter action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free...

CVE-2018-19451

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution...

CVE-2018-19452

A use after free in the TextBox field Mouse Enter action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free...

Command injection

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution...

CVE-2018-19452

A use after free in the TextBox field Mouse Enter action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free...

CVE-2018-19451

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution...

CVE-2018-19451

Foxit Reader SDK ActiveX Pro (pre-5.5.1, e.g., 5.4.0.1031) is affected by CVE-2018-19451: a command injection via the Open File action on a Field can lead to remote code execution. The issue stems from inadequate validation when using a user-supplied string to invoke system calls. Exploitation re...

CVE-2018-19451

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution...

CVE-2018-19452

CVE-2018-19452 and related entries describe a use-after-free vulnerability in Foxit Reader SDK ActiveX (Professional 5.4.0.1031). The issue occurs in the IReader_ContentProvider when a Mouse Enter action triggers a use-after-free on the TextBox field, allowing remote code execution. The Red Hat/N...

CVE-2018-19452

A use after free in the TextBox field Mouse Enter action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free...

PT-2019-9819

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK ActiveX Professional version 5.4.0.1031 Description A use after free issue in the TextBox field Mouse Enter action in IReader ContentProvider can be triggered by specially crafted PDF files, potentially allowing an attacker to...

PT-2019-9818

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK ActiveX Professional version 5.4.0.1031 Description A command injection issue can occur when processing specially crafted PDF files using the Open File action on a Field, potentially allowing an attacker to achieve remote code...