CVE-2018-9947

Foxit Reader 9.0.0.29935 is affected by CVE-2018-9947, a heap-based buffer overflow in BMP image parsing. The flaw arises from improper validation of the length of user-supplied data before copying to a fixed-length heap buffer, allowing remote code execution. Exploitation requires user interacti...

CVE-2018-9935

Foxit Reader 8.3.2.25013 is affected by a remote code execution vulnerability in the addField method. The root cause is failing to validate the existence of an object before operating on it, leading to potential code execution under the current process context. Public sources (ZDI-18-319) describ...

CVE-2018-9964

CVE-2018-9964 affects Foxit Reader 9.0.1.1049, where the vulnerability lies in parsing the name attribute of OCG objects. The issue stems from not validating the existence of an object before performing operations, enabling remote code execution in the context of the current process. The vulnerab...

CVE-2018-10476

Foxit Reader 9.0.0.29935 is affected by an information-disclosure vulnerability in the U3D Model Node parsing. The issue stems from improper validation of user-supplied data, causing a read past the end of an allocated structure (out-of-bounds read). An attacker can leverage this by convincing a ...

CVE-2018-9969

CVE-2018-9969 affects Foxit Reader (v9.0.1.1049) and is due to a flaw in the XFA boundItem method of Button elements. The vulnerability arises from not validating the existence of an object before performing operations, enabling remote code execution under the process context when a user opens a ...

CVE-2018-9949

CVE-2018-9949 affects Foxit Reader 9.0.0.29935. The issue is a TIFF parsing heap-based buffer overflow caused by insufficient validation of user-supplied data length, allowing remote code execution with the current process context. Exploitation requires user interaction (visiting a malicious page...

CVE-2018-10480

Foxit Reader 9.0.0.29935 is affected by CVE-2018-10480 due to improper validation in the handling of the U3D Node Name buffer, causing a read past the end of an allocated buffer. The vulnerability can disclose sensitive information and, in conjunction with other vulnerabilities, may allow code ex...

CVE-2018-9962

Foxit Reader 9.0.1.1049 is affected by CVE-2018-9962. The vulnerability stems from parsing of the Annotation author attribute and a missing validation of object existence, enabling remote code execution when a user opens a malicious file or visits a malicious page. The root cause is a use-after-f...

CVE-2018-9946

Foxit Reader 9.0.0.29935 is affected by CVE-2018-9946 due to a setTimeOut handling flaw where code executes without validating the existence of an object before operations. This can disclose sensitive information; exploitation requires user interaction (visit a malicious page or open a malicious ...

CVE-2018-9951

Foxit Reader 9.0.0.29935 is affected by CVE-2018-9951, a CPDF_Object handling flaw that lacks validation of object existence, enabling remote code execution under the current process context. Exploit requires user interaction (visiting a malicious page or opening a malicious file). The issue is d...

CVE-2018-1173

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-9942

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-9970

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA...

CVE-2018-1180

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-10494

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-9948

The provided connected documents confirm CVE-2018-9948 affects Foxit Reader (notably v9.0.x), describing a Use-After-Free flaw in the Text Annotations component and in TypedArray handling due to uninitialized pointers. Exploitation requires a crafted PDF/file and can lead to remote code execution...

CVE-2018-10489

Affected software: Foxit Reader 9.0.0.29935. Vulnerability: U3D Clod Progressive Mesh Declaration parsing flaw leading to an out-of-bounds write. Root cause: Lack of proper validation of user-supplied data in the U3D Mesh Declaration parsing, causing a write past the end of an allocated structure...

CVE-2018-9957

The CVE-2018-9957 issue affects Foxit Reader 9.0.1.1049. It stems from the handling of XFA Button elements: during parsing of arguments passed to the resetData method, the code does not properly validate the existence of an object before performing operations, enabling a remote attacker to execut...

CVE-2018-10473

CVE-2018-10473 affects Foxit Reader 9.0.0.29935 and is due to improper validation in the parsing of U3D CLOD Base Mesh Continuation structures, causing an out-of-bounds write that can execute arbitrary code. The vulnerability permits remote code execution and requires user interaction (visiting a...

CVE-2018-9963

Foxit Reader 9.0.1.1049 is affected by a JPEG2000 parsing flaw that allows an out-of-bounds read, enabling information disclosure and potentially code execution in the context of the current process. The vulnerability arises from inadequate validation of user-supplied data, resulting in a read pa...