Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Type confusion

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Type confusion

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

CVE-2020-10913

The CVE-2020-10913 issue is a Type Confusion remote code execution in Foxit PhantomPDF/Reader caused by improper validation in the OCRAndExportToExcel command of the communication API. Exploitation requires user interaction (the target must visit a malicious page or open a malicious file). Affect...

CVE-2020-10911

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-10912

CVE-2020-10912 affects Foxit PhantomPDF (and Foxit Reader/PhantomPDF family) and is tied to the SetFieldValue command in Foxit’s communication API. The root cause is a lack of validation of user-supplied data, leading to a type confusion condition and enabling arbitrary code execution in the cont...

CVE-2020-10911

CVE-2020-10911 affects Foxit PhantomPDF (and Foxit Reader/PhantomPDF family in some sources) with a type-confusion flaw in the GetFieldValue handling of the communication API that enables remote code execution. Exploitation requires user interaction (e.g., opening a malicious file/page). The vuln...

CVE-2020-10912

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-10908

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-10909

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-10910

CVE-2020-10910 affects Foxit PhantomPDF/Reader (notably PhantomPDF 9.7.0.29478; CNVD/ZDI notes 9.7.1.29511 and earlier) where the RotatePage command handling in the communication API is vulnerable to a type confusion caused by insufficient validation of user-supplied data. This allows remote code...

CVE-2020-10908

CVE-2020-10908 affects Foxit PhantomPDF 9.7.0.29478. The issue is a type confusion in the Export command handling within the communication API, arising from insufficient validation of user-supplied data. It enables remote code execution in the context of the current process and requires user inte...

CVE-2020-10909

Foxit PhantomPDF (and related Foxit PDF products) is affected by CVE-2020-10909 due to a type-confusion in the AddWatermark handling of the communication API. The root cause is improper validation of user-supplied data, enabling remote code execution on the current process after user interaction ...

CVE-2020-10910

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-10904

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-10904

CVE-2020-10904 affects Foxit PhantomPDF (and Foxit Reader components) with a flaw in U3D object handling in PDF files, allowing remote code execution via write past the end of an allocated object. The vulnerability requires user interaction (visiting a malicious page or opening a malicious file) ...

CVE-2020-10905

CVE-2020-10905 affects Foxit PhantomPDF 9.7.1.29511. The issue is an out-of-bounds read in U3D vertex handling due to insufficient validation, requiring user interaction (malicious page/file) and potentially enabling code execution when combined with other vulnerabilities. Multiple sources (ZDI-2...

CVE-2020-10903

CVE-2020-10903 affects Foxit PhantomPDF 9.7.1.29511, where U3D objects in PDFs are not properly validated, causing an out-of-bounds read that can disclose sensitive data. The issue requires user interaction (visiting a malicious page or opening a malicious file) and, in combination with other vul...