CVE-2017-10941

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2017-10947

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the prin...

CVE-2017-10947

CVE-2017-10947 affects Foxit Reader 8.2.1.6871 and Foxit PhantomPDF prior to 8.3.1, where a use-after-free in the print() function arises from not validating object existence before operations. This allows remote code execution under the process context when a user opens a crafted document or vis...

CVE-2017-10945

Foxit Reader 8.3.0.14878 (and earlier) is affected by CVE-2017-10945 due to a use-after-free in the app.alert function caused by not validating an object before operations. This enables remote code execution with user interaction required (target must open a malicious file/page). Related advisori...

CVE-2017-10948

CVE-2017-10948 affects Foxit Reader (v8.2.1.6871) and is caused by a failure to validate an object before operations in app.execMenuItem, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a crafted file). Multiple connected sources (OpenV...

CVE-2017-10941

Foxit Reader/Phantom versions up to 8.3.0.14878 (and earlier) are affected by CVE-2017-10941 and related CVEs. The root cause is a use-after-free in AFParseDateEx due to failing to validate object existence before operations, enabling remote code execution under the process context. Exploitation ...

CVE-2017-10953

CVE-2017-10953 affects Foxit Reader (up to 8.3.1.21155). The flaw is in the gotoURL method, where an unvalidated user-supplied string is used to perform a system call, enabling remote code execution. Exploitation requires user interaction (victim opens a malicious file or visits a crafted page). ...

CVE-2017-10943

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2017-10946

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2017-10944

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Foxit Reader Buffer Overflow Vulnerability (CNVD-2017-36065)

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A buffer overflow vulnerability exists in Foxit Reader version 8.3.2.25013. A remote attacker can exploit this vulnerability with a specially crafted .xps file to cause a denial of service or execute arbitrary code...

Foxit Reader Buffer Overflow Vulnerability (CNVD-2017-36066)

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A buffer overflow vulnerability exists in Foxit Reader version 8.3.2.25013. A remote attacker can exploit this vulnerability with a specially crafted .xps file to cause a denial of service or execute arbitrary code...

Foxit Reader Arbitrary Code Execution and Denial of Service Vulnerabilities - Windows

Foxit Reader is prone to a code execution and denial of service vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 16, 2017

Various forms of fuzzing techniques that search for vulnerabilities in software programs have been around for several decades, but it can a tedious task, especially when looking at an entire enterprise application. Earlier this week, Zero Day Initiative ZDI vulnerability researcher Abdul-Aziz...

Foxit Reader Buffer Overflow Vulnerability (CNVD-2017-35136)

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A security vulnerability exists in Foxit Reader version 8.3.2.25013. An attacker can exploit this vulnerability with a specially crafted .pdf file to cause a denial of service or execute arbitrary code...

Foxit Reader and PhantonPDF XFA gotoURL Command Injection (CVE-2017-10953; CVE-2019-8160)

A command injection vulnerability exists in the XFA component of Foxit Reader and PhantomPDF. This vulnerability is due to improper handling of user-supplied string for the gotoURL function call. A remote attacker could exploit this vulnerability by enticing a victim user to visit a malicious web...

Code injection

Foxit Reader 8.3.2.25013 and earlier and Foxit PhantomPDF 8.3.2.25013 and earlier, when running in single instance mode, allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to "Data from Faulting Address controls Code Flow starting at...

CVE-2017-14694

Foxit Reader 8.3.2.25013 and earlier and Foxit PhantomPDF 8.3.2.25013 and earlier, when running in single instance mode, allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to "Data from Faulting Address controls Code Flow starting at...

CVE-2017-14694

Foxit Reader 8.3.2.25013 and earlier and Foxit PhantomPDF 8.3.2.25013 and earlier, when running in single instance mode, allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to "Data from Faulting Address controls Code Flow starting at...

CVE-2017-14694

CVE-2017-14694 affects Foxit Reader 8.3.2.25013 and earlier and Foxit PhantomPDF 8.3.2.25013 and earlier when running in single instance mode. The vulnerability allows arbitrary code execution or denial of service via a crafted PDF, due to a fault in Data from Faulting Address that controls code ...