CVE-2018-19444: Use After Free

A use after free in the TextBox field Validate action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19452, this has a different free locatio...

CVE-2018-19445: Improper Neutralization of Special Elements used in a Command

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API app.launchURL is used. An attacker can leverage this to gain remote code execution...

CVE-2018-19446: Incorrect Permission Assignment for Critical Resource

A File Write can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API Doc.createDataObject is used. An attacker can leverage this to gain remote code execution...

CVE-2018-19447: Out-of-bounds Write

A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK ActiveX 5.4.0.1031 when parsing the URI string. An attacker can leverage this to gain remote code execution...

CVE-2018-19448: Out-of-bounds Write

In Foxit Reader SDK ActiveX Professional 5.4.0.1031, an uninitialized object in IReaderContentProvider::GetDocEventHandler occurs when embedding the control into Office documents. By opening a specially crafted document, an attacker can trigger an out of bounds write condition, possibly leveragin...

CVE-2018-19449: Out-of-bounds Write

A File Write can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API Doc.exportAsFDF is used. An attacker can leverage this to gain remote code execution...

CVE-2018-19450: Improper Neutralization of Special Elements used in a Command

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX 5.4.0.1031 when parsing a launch action. An attacker can leverage this to gain remote code execution...

PT-2019-9812

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK ActiveX Professional version 5.4.0.1031 Description The issue allows a File Write to occur for specially crafted PDF files when the JavaScript API Doc.createDataObject is used. This can be leveraged by an attacker to gain remo...

CVE-2018-19452

A use after free in the TextBox field Mouse Enter action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free...

CVE-2018-19451

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution...

Command injection

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution...

Remote code execution

A use after free in the TextBox field Mouse Enter action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free...

CVE-2018-19451

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution...

CVE-2018-19452

A use after free in the TextBox field Mouse Enter action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free...

CVE-2018-19451

A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution...

CVE-2018-19451

Foxit Reader SDK ActiveX Pro (pre-5.5.1, e.g., 5.4.0.1031) is affected by CVE-2018-19451: a command injection via the Open File action on a Field can lead to remote code execution. The issue stems from inadequate validation when using a user-supplied string to invoke system calls. Exploitation re...

CVE-2018-19452

CVE-2018-19452 and related entries describe a use-after-free vulnerability in Foxit Reader SDK ActiveX (Professional 5.4.0.1031). The issue occurs in the IReader_ContentProvider when a Mouse Enter action triggers a use-after-free on the TextBox field, allowing remote code execution. The Red Hat/N...

CVE-2018-19452

A use after free in the TextBox field Mouse Enter action in IReaderContentProvider can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free...

PT-2019-9818

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK ActiveX Professional version 5.4.0.1031 Description A command injection issue can occur when processing specially crafted PDF files using the Open File action on a Field, potentially allowing an attacker to achieve remote code...

PT-2019-9819

Name of the Vulnerable Software and Affected Versions Foxit Reader SDK ActiveX Professional version 5.4.0.1031 Description A use after free issue in the TextBox field Mouse Enter action in IReader ContentProvider can be triggered by specially crafted PDF files, potentially allowing an attacker to...