CVE-2018-14253

The CVE-2018-14253 entry concerns Foxit Reader (variants of Foxit Reader 9.0.1.1049 and affected 9.x lines). The vulnerability is a type-confusion in the getIcon method that enables remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious fil...

CVE-2018-14291

Foxit Reader CVE-2018-14291 is a PDF parsing vulnerability (use-after-free) that allows remote code execution when an attacker manipulates PDF elements; user interaction (open a malicious file/page) is required. The weakness is in the parsing of PDF documents, specifically a pointer reuse after f...

CVE-2018-14245

CVE-2018-14245 affects Foxit Reader (e.g., version 9.0.1.1049) and is caused by a type confusion in the closeDoc method. An attacker can trigger remote code execution by convincing a user to open a malicious page or file, with user interaction required. Documented advisories (ZDI-18-705 and relat...

CVE-2018-14241

CVE-2018-14241 affects Foxit Reader (9.0.1.1049) and is a type-confusion/remote code execution flaw in the addAnnot method. Exploitation requires user interaction (the target visits a malicious page or opens a malicious file); an attacker can trigger the type confusion via JavaScript to execute c...

CVE-2018-14315

CVE-2018-14315 affects Foxit Reader versions older than 9.2.0.9097, where the vulnerability lies in how annotations are handled. The flaw is due to not validating the existence of an object before performing operations, enabling remote code execution in the context of the current process when a u...

CVE-2018-14270

CVE-2018-14270 = Foxit Reader remote code execution via removeDataObject type confusion. Affected: Foxit Reader 9.0.1.1049 (and older) with the vulnerability triggered by JavaScript actions on a malicious page or file; requires user interaction. Root cause is a type confusion in removeDataObject ...

CVE-2018-14273

CVE-2018-14273 affects Foxit Reader (and related Foxit products) with a type confusion in the removeTemplate method that enables remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The flaw allows code execution in the context of ...

CVE-2018-14257

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14311

CVE-2018-14311 affects Foxit Reader (and Foxit PhantomPDF) via a type confusion in XFA event handling. The flaw arises from improper validation of user-supplied data, enabling remote code execution when a user opens a malicious file or visits a crafted page. Exploitation requires user interaction...

CVE-2018-14251

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14284

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-11621

Foxit Reader (Windows) vulnerability CVE-2018-11621 affects Foxit Reader 9.0.1.1049 with the ConvertToPDF_x86.dll causing an out-of-bounds read that discloses sensitive information. Exploitation requires user interaction (visiting a malicious page or opening a malicious file); an attacker could l...

CVE-2018-14292

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14270

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14251

Foxit Reader CVE-2018-14251 is a type-confusion remote code execution affecting Foxit Reader 9.0.1.1049. The flaw occurs in getDataObject and can be triggered via actions in JavaScript after the user visits a malicious page or opens a malicious file, enabling code execution in the current process...

CVE-2018-14268

Foxit Reader CVE-2018-14268 is a type-confusion remote code execution in the mailForm method of Foxit Reader (9.0.1.1049 and earlier). Exploitation requires user interaction (visiting a malicious page or opening a crafted file). The flaw enables code execution under the current process context an...

CVE-2018-14309

Foxit Reader CVE-2018-14309 is a use-after-free in handling of the SeedValue Generic Object passed to signatureSetSeedValue, enabling remote code execution with user interaction. Affected products include Foxit Reader versions older than 9.2.0.9097 (and Foxit PhantomPDF pre-9.2.0.9097). The root ...

CVE-2018-14259

CVE-2018-14259 is a type-confusion remote-code-execution vulnerability in Foxit Reader (affecting 9.0.1.1049). The flaw resides in getPageNthWordQuads and can be triggered via JavaScript when a user opens a malicious file or visits a crafted page, allowing code execution in the current process co...

CVE-2018-14304

Foxit Reader vulnerable to a Use-After-Free in the Text annotation handling that can allow remote code execution. Affected products include Foxit Reader prior to version 9.2.0.9097 (and Foxit PhantomPDF), with exploitation requiring user interaction (visiting a malicious page or opening a crafted...

CVE-2018-14249

CVE-2018-14249 is a type-confusion remote code execution in Foxit Reader’s exportDataObject method. Affected product: Foxit Reader (9.0.1.1049) with exploitation requiring user interaction (malicious page or file) via JavaScript to trigger the flaw. Documents also reference a broader set of relat...