CVE-2018-11623

CVE-2018-11623 affects Foxit Reader 9.0.1.1049 where the vulnerability is in the addAdLayer method, causing a type-confusion condition that allows remote code execution when a user visits a malicious page or opens a malicious file, with user interaction required. The issue is documented in ZDI-18...

CVE-2018-14275

Foxit Reader CVE-2018-14275: A type confusion in spawnPageFromTemplate in Foxit Reader (affecting versions including 9.0.1.1049) allows remote code execution when a user visits a malicious page or opens a malicious file; exploitation requires user interaction and can execute code in the current p...

CVE-2018-14256

CVE-2018-14256 affects Foxit Reader, where the flaw is in the getOCGs method leading to a type confusion and remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a crafted file). Affected: Foxit Reader 9.0.1.1049 (and related Foxit products); multipl...

CVE-2018-14243

CVE-2018-14243 concerns Foxit Reader. Multiple connected sources (ZDI-18-703, CNVD-2018-14462, OpenVAS entry) describe a type confusion vulnerability in the addPageOpenJSMessage method that allows remote code execution when a user opens a malicious page/file and executes JavaScript. Affected prod...

CVE-2018-14302

CVE-2018-14302 affects Foxit Reader (Windows) via a remote code execution vulnerability in Square annotations. The flaw is an use-after-free in processing of annotations that can be triggered when a user visits a malicious page or opens a malicious file, enabling arbitrary code execution in the c...

CVE-2018-11617

CVE-2018-11617 affects Foxit Reader (9.0.0.29935 and earlier) via a use-after-free in the handling of Format events for ComboBox fields. The root cause is failure to validate the existence of an object before performing operations on it, allowing remote attackers to execute arbitrary code with th...

CVE-2018-14279

Foxit Reader CVE-2018-14279 is a remote code execution due to a type confusion in the resetForm method. Exploitation requires user interaction (visit a malicious page or open a malicious file). Affected product scope includes Foxit Reader (versions before the latest provided in advisories) and is...

CVE-2018-14247

Foxit Reader CVE-2018-14247 is a type-confusion remote code execution vulnerability in the exportAsFDF method. Exploitation requires user interaction (visiting a malicious page or opening a malicious file via JavaScript) and can execute code under the current process. Connected advisories (e.g., ...

CVE-2018-14246

CVE-2018-14246 affects Foxit Reader (e.g., version 9.0.1.1049) where the convertTocPDF method can trigger a type confusion in JavaScript, allowing remote code execution after user interaction (visiting a malicious page or opening a malicious file). Multiple connected advisories confirm the root c...

CVE-2018-14289

CVE-2018-14289 affects Foxit Reader, including version 9.0.1.5096, with an out-of-bounds read in PDF document parsing that can disclose sensitive information. The vulnerability requires user interaction (visiting a malicious page or opening a malicious file) and can be leveraged with other issues...

CVE-2018-14292

CVE-2018-14292 affects Foxit Reader (e.g., 9.0.1.5096 and older) where a vulnerability in PDF parsing can cause a use-after-free in document element handling, enabling remote code execution in the current process. Exploitation requires user interaction (target must open a malicious page or file)....

CVE-2018-14300

CVE-2018-14300 describes a remote code execution vulnerability in Foxit Reader caused by a use-after-free in the handling of Polygon annotations. The flaw reuses a freed pointer during document element processing, enabling an attacker to run arbitrary code in the victim process when a user opens ...

CVE-2018-14312

CVE-2018-14312 affects Foxit Reader 9.0.1.5096 due to a use-after-free in the exportAsFDF function, caused by not validating object existence before dereferencing. This enables remote code execution when a user opens a malicious file or visits a malicious page. Connected sources confirm the vulne...

CVE-2018-14311

CVE-2018-14311 affects Foxit Reader (and Foxit PhantomPDF) via a type confusion in XFA event handling. The flaw arises from improper validation of user-supplied data, enabling remote code execution when a user opens a malicious file or visits a crafted page. Exploitation requires user interaction...

CVE-2018-14294

CVE-2018-14294 affects Foxit Reader; vulnerable component is the processing of FileAttachment annotations. An attacker can craft a document to trigger a use-after-free, enabling remote code execution in the current process after user opens a malicious file or visits a malicious page. Impact is re...

CVE-2018-14249

CVE-2018-14249 is a type-confusion remote code execution in Foxit Reader’s exportDataObject method. Affected product: Foxit Reader (9.0.1.1049) with exploitation requiring user interaction (malicious page or file) via JavaScript to trigger the flaw. Documents also reference a broader set of relat...

CVE-2018-14282

CVE-2018-14282 affects Foxit Reader prior to 9.2.0.9097. The vulnerability is a FlateDecode stream handling issue caused by an uninitialized pointer, enabling remote code execution under the current process when a user opens a malicious file or visits a malicious page. Exploitation requires user ...

CVE-2018-14245

CVE-2018-14245 affects Foxit Reader (e.g., version 9.0.1.1049) and is caused by a type confusion in the closeDoc method. An attacker can trigger remote code execution by convincing a user to open a malicious page or file, with user interaction required. Documented advisories (ZDI-18-705 and relat...

CVE-2018-14298

CVE-2018-14298 affects Foxit Reader up to 9.0.1.5096 (Windows). The flaw is a use-after-free in Ink annotations processing, allowing arbitrary code execution when a user opens a poisoned document or visits a malicious page. Root cause: pointer reuse after free during document element manipulation...

CVE-2018-11621

Foxit Reader (Windows) vulnerability CVE-2018-11621 affects Foxit Reader 9.0.1.1049 with the ConvertToPDF_x86.dll causing an out-of-bounds read that discloses sensitive information. Exploitation requires user interaction (visiting a malicious page or opening a malicious file); an attacker could l...