CVE-2017-16585

Foxit Reader 8.3.2.25013 contains a remote code execution flaw in the app.response method caused by not validating an object before operating on it. An attacker can exploit this via a user-interaction (visiting a malicious page or opening a malicious file) to run code in the process context. Conn...

CVE-2017-10957

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2017-14828

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the w...

CVE-2017-14826

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2017-16573

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2017-10959

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2017-14821

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2017-10957

CVE-2017-10957 affects Foxit Reader 8.3.1.21155. The flaw is in the arrowEnd attribute of Annotation objects, arising from not validating the existence of an object before operating on it, enabling remote code execution in the current process. Exploitation requires user interaction (visiting a ma...

CVE-2017-14830

CVE-2017-14830 affects Foxit Reader 8.3.1.21155. The flaw is in the XFAScriptObject.setFocus method, caused by improper validation of user-supplied data, leading to a type confusion condition and remote code execution when a user visits a malicious page or opens a malicious file. Exploitation det...

CVE-2017-14827

CVE-2017-14827 affects Foxit Reader 8.3.1.21155 where the append method of XFA Node objects fails to properly validate user-supplied data, causing a type-confusion vulnerability that enables remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a mali...

CVE-2017-14829

CVE-2017-14829 affects Foxit Reader 8.3.1.21155. The flaw is in XFAScriptObject.openList, caused by improper validation of user-supplied data, leading to a type confusion condition that allows remote code execution in the current process when a user opens a malicious page or file. Exploitation re...

CVE-2017-14837

CVE-2017-14837 affects Foxit Reader 8.3.1.21155, with a remote code execution flaw in the XFA Layout objects pageSpan method caused by improper validation of user-supplied data, enabling code execution with user interaction (via a malicious page or file). Multiple corroborating sources classify t...

CVE-2017-14825

CVE-2017-14825 affects Foxit Reader; vulnerability is a type confusion in XFAScriptObject.remove, enabling remote code execution. Affected: Foxit Reader 8.3.1.21155 with user interaction required (malicious page/file). Documented exploitation exists (malware in the wild per OpenVAS/OpenVAS notes)...

CVE-2017-14818

CVE-2017-14818 affects Foxit Reader 8.3.1.21155 and relates to an out-of-bounds/read past end during JPEG2000 image parsing inside embedded PDFs. The flaw arises from insufficient validation of user-supplied data, enabling a remote attacker to disclose sensitive information and, in conjunction wi...

CVE-2017-14833

CVE-2017-14833 affects Foxit Reader 8.3.1.21155 and related builds, where the style attribute of Text Annotation objects can be manipulated after object existence is not validated, enabling remote code execution in the current process. Exploitation requires user interaction (visiting a malicious ...

CVE-2017-16583

Foxit Reader 8.3.2.25013 is vulnerable to a remote code execution flaw in the XFA dataset element (missing validation of object existence). Exploitation requires user interaction (visiting a malicious page or opening a malicious file) and can execute code with the current process context. Affecte...

CVE-2017-10959

CVE-2017-10959 affects Foxit Reader 8.3.1.21155 and is due to a flaw in the Link objects’ setAction method where the code fails to validate object existence before acting, enabling remote code execution in the current process. Exploitation typically requires user interaction (visiting a malicious...

CVE-2017-16589

CVE-2017-16589 affects Foxit Reader 8.3.1.21155, where the vulnerability lies in parsing the yTsiz member of SIZ markers. The flaw causes an out-of-bounds read due to insufficient validation of user-supplied data, and can be exploited remotely by convincing a user to open a malicious page or file...

CVE-2017-16586

CVE-2017-16586 affects Foxit Reader 8.3.2.25013 (Windows) with a use-after-free-like flaw in addAnnot that fails to validate object existence before performing operations, enabling remote code execution under the current process when a user opens a malicious page or file. Exploitation requires us...

CVE-2017-16574

Summary (CVE-2017-16574): Foxit Reader (8.3.1.21155) is affected by an information-disclosure vulnerability in the Image filters parsing, caused by inadequate validation of user-supplied data, which can lead to an out-of-bounds read. Exploitation requires user interaction (visiting a malicious pa...