CVE-2018-17680

CVE-2018-17680 affects Foxit Reader 9.2.0.9297 (Windows). The vulnerability is in the handling of the style property of a Field object, due to missing validation before operations, leading to use-after-free and remote code execution. Exploitation requires user interaction (visiting a malicious pa...

CVE-2018-17666

CVE-2018-17666 affects Foxit Reader 9.2.0.9297 and earlier for Windows, with a flaw in the exportData host object handling that fails to validate object existence, enabling remote code execution via a malicious page or file and requiring user interaction. The root cause is a lack of existence val...

CVE-2018-17634

CVE-2018-17634 affects Foxit Reader 9.2.0.9297 and earlier; the vulnerability is a use-after-free in the attachIcon handling of Annotation objects, caused by not validating the existence of an object before operations. Remote code execution is possible with user interaction (visit a malicious pag...

CVE-2018-17661

CVE-2018-17661 affects Foxit Reader 9.2.0.9297 and earlier on Windows. The flaw is in the handling of the messageBox method of the Host object, stemming from not validating the existence of an object before performing operations, enabling remote code execution. Exploitation requires user interact...

CVE-2018-17632

Foxit Reader 9.2.0.9297 is affected by CVE-2018-17632. The flaw lies in the resolveNode handling, where lack of validation of an object before operations leads to a use-after-free condition, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or openi...

CVE-2018-17627

Foxit Reader/PhantomPDF for Windows (Foxit Reader 9.2.0.9297 and earlier) contains a vulnerability in the XFA mouseUp handling that can trigger a use-after-free, allowing remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). Affecte...

CVE-2018-17630

Foxit Reader openPlayer Use-After-Free remote Code Execution (CVE-2018-17630) affects Foxit Reader and related components. The root cause is failure to validate the existence of an object before performing operations in the openPlayer method, enabling an attacker to execute code in the process co...

CVE-2018-17672

Foxit Reader

CVE-2018-17674

Foxit Reader 9.2.0.9297 (and older) is affected by CVE-2018-17674. The issue is a memory misreference/use-after-free in the handling of the name property of Annotation objects, arising from not validating the existence of an object before operations. Exploitation requires user interaction (target...

CVE-2018-17686

CVE-2018-17686 affects Foxit Reader (Windows) with a BMP image processing flaw. The connected advisories describe an out-of-bounds read in the BMP handling that can disclose sensitive information, requiring user interaction (e.g., visiting a malicious page or opening a malicious file). The vulner...

CVE-2018-17697

Foxit Reader 9.2.0.9297 and earlier are affected by a templates handling vulnerability where code executes due to a missing object existence check, enabling remote code execution after user opens a malicious page/file. Exploitation requires user interaction; advisory ZDI-18-1215 describes a use-a...

CVE-2018-17667

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17626

Summary: Foxit Reader shows a text box handling flaw that can lead to remote code execution. The root cause is a use-after-free-like issue in the TextBox Validate event path where code does not verify that the target object exists before operating on it. This allows an attacker to run arbitrary c...

CVE-2018-17685

Foxit Reader 9.2.0.9297 is affected by CVE-2018-17685 due to a type confusion in PDF handling. The issue allows remote code execution when a user opens a malicious file or visits a malicious page, and requires user interaction. The vulnerability is confirmed across multiple sources (e.g., ZDI-18-...

CVE-2018-17683

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17679

Foxit Reader 9.2.0.9297 and earlier versions are affected by CVE-2018-17679, a PDF parsing vulnerability that allows remote code execution via a use-after-free in document element handling. The flaw can be triggered when a user opens a malicious file or visits a malicious page, enabling code exec...

CVE-2018-17653

The CVE-2018-17653 entry concerns Foxit Reader 9.2.0.9297 (and earlier) where the flaw is in the TimeField.resolveNode handling; the code fails to verify the existence of an object before performing operations, enabling remote code execution in the current process. Exploitation requires user inte...

CVE-2018-17659

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17651

Foxit Reader 9.2.0.9297 contains a use-after-free/invalid object access flaw in the TimeField getItemState handler, where code executes without validating the existence of the object. This can allow remote code execution when a user opens a malicious file or visits a crafted page, as described by...

CVE-2018-17627

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...