CVE-2018-14250

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14253

The CVE-2018-14253 entry concerns Foxit Reader (variants of Foxit Reader 9.0.1.1049 and affected 9.x lines). The vulnerability is a type-confusion in the getIcon method that enables remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious fil...

CVE-2018-14288

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14285

CVE-2018-14285 affects Foxit Reader 9.0.1.1049 (Windows) and is caused by improper validation in handling of the oneOfChild attribute, leading to a type confusion condition that allows remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious ...

CVE-2018-14262

CVE-2018-14262 affects Foxit Reader (example affected build: 9.0.1.1049). The root cause is a type confusion in the getURL method that can be triggered through JavaScript actions, allowing remote code execution with the attacker’s code running in the current process context. User interaction is r...

CVE-2018-11618

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14293

CVE-2018-14293 affects Foxit Reader 9.1.0.5096 and earlier, where parsing of PDF documents can trigger a use-after-free in the PDF handling code, allowing remote code execution when a user opens a malicious file or visits a malicious page. The vulnerability requires user interaction and executes ...

CVE-2018-11617

CVE-2018-11617 affects Foxit Reader (9.0.0.29935 and earlier) via a use-after-free in the handling of Format events for ComboBox fields. The root cause is failure to validate the existence of an object before performing operations on it, allowing remote attackers to execute arbitrary code with th...

CVE-2018-14257

CVE-2018-14257 is a Foxit Reader remote code execution vulnerability in the getPageBox method that enables code execution via crafted JavaScript when a user visits a malicious page or opens a malicious file. The issue is a type confusion condition triggered by actions in JavaScript, allowing an a...

CVE-2018-14297

CVE-2018-14297 affects Foxit Reader (and Foxit PhantomPDF in some listings). The vulnerability is a use-after-free in the processing of FreeText annotations, where manipulating a document’s elements can cause a freed pointer to be reused, enabling remote code execution. Exploitation requires user...

CVE-2018-14283

CVE-2018-14283 affects Foxit Reader (Windows) versions older than 9.2.0.9097. The flaw is in the highlightMode attribute and stems from not validating the existence of an object before performing operations on it, leading to a use-after-free condition that enables remote code execution under the ...

CVE-2018-14279

Foxit Reader CVE-2018-14279 is a remote code execution due to a type confusion in the resetForm method. Exploitation requires user interaction (visit a malicious page or open a malicious file). Affected product scope includes Foxit Reader (versions before the latest provided in advisories) and is...

CVE-2018-14245

CVE-2018-14245 affects Foxit Reader (e.g., version 9.0.1.1049) and is caused by a type confusion in the closeDoc method. An attacker can trigger remote code execution by convincing a user to open a malicious page or file, with user interaction required. Documented advisories (ZDI-18-705 and relat...

CVE-2018-14244

Foxit Reader is affected by CVE-2018-14244 (also listed in ZDI as ZDI-18-704). The flaw is a type-confusion in the calculateNow method, exploitable via JavaScript actions that trigger the vulnerability and lead to remote code execution. Exploitation requires user interaction (visiting a malicious...

CVE-2018-14254

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14309

Foxit Reader CVE-2018-14309 is a use-after-free in handling of the SeedValue Generic Object passed to signatureSetSeedValue, enabling remote code execution with user interaction. Affected products include Foxit Reader versions older than 9.2.0.9097 (and Foxit PhantomPDF pre-9.2.0.9097). The root ...

CVE-2018-14273

CVE-2018-14273 affects Foxit Reader (and related Foxit products) with a type confusion in the removeTemplate method that enables remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The flaw allows code execution in the context of ...

CVE-2018-14316

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-14271

The CVE-2018-14271 entry describes a type-confusion remote code execution in Foxit Reader, caused by the removeField method. The flaw allows code execution in the current process context and requires user interaction (visiting a malicious page or opening a malicious file). Affected products inclu...

CVE-2018-14242

CVE-2018-14242 is a type-confusion remote code execution vulnerability in Foxit Reader, fixed by updates after Foxit Reader 9.2.0.9097. The flaw resides in the addField method and can be triggered by JavaScript actions on a malicious page or file, requiring user interaction. Impact is arbitrary c...