Foxit Reader Integer Overflow Remote Code Execution Vulnerability

Foxit Reader old name: Foxit PDF Reader is a set of software used to read PDF format files, by Fujian Foxit Software developed by Foxit Reader is a set of free to use the software, the operating system is mainly based on Microsoft Windows, and as long as there is a Win32 implementation of the...

CVE-2020-8857

CVE-2020-8857 affects Foxit Reader 9.7.0.29455 (and related versions in some records) where the flaw resides in parsing of form Annotation objects within AcroForms. The root cause is failure to validate the existence of an object before performing operations on it, leading to remote code executio...

CVE-2020-8856

CVE-2020-8856 (Foxit PhantomPDF) affects Foxit PhantomPDF 9.6.0.25608 and possibly earlier builds, with a flaw in the handling of watermarks. The root cause is the failure to validate the existence of an object before performing operations on it, enabling an attacker to execute arbitrary code in ...

CVE-2020-8853

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-8854

Foxit PhantomPDF is vulnerable to a JPEG-to-PDF conversion out-of-bounds write that can lead to remote code execution. Affected product: Foxit PhantomPDF 9.7.0.29478 (and earlier per CNVD), with the flaw caused by improper validation of user-supplied data during JPEG-to-PDF conversion, resulting ...

CVE-2020-8855

Foxit PhantomPDF 9.7.0.2947 (and earlier versions) is affected by a use-after-free in fxhtml2pdf.exe that hinges on failing to validate the existence of an object before operations, enabling remote code execution when a user visits a crafted page or opens a malicious file. The issue allows code e...

CVE-2020-8853

Foxit PhantomPDF 9.7.0.29478 is vulnerable to a HTML2PDF conversion out-of-bounds write that can allow remote code execution. The flaw arises from insufficient validation of user-supplied data during HTML-to-PDF conversion, enabling a write past the end of an allocated structure. Exploitation req...

CVE-2020-8854

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-8852

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...

CVE-2020-8851

Foxit Reader 9.7.0.29455 is affected by a JPEG2000 processing vulnerability that allows remote code execution via out-of-bounds write due to insufficient validation of data, requiring user interaction (visiting a malicious page or opening a malicious file). The issue (CVE-2020-8851) is documented...

CVE-2020-8852

CVE-2020-8852 affects Foxit Reader 9.7.0.29455 (and related records) with an out-of-bounds read in JPEG2000 file processing that can disclose sensitive information. Root cause: insufficient validation of user-supplied data leading to a read past the end of an allocated buffer. Attack requires use...

CVE-2020-8849

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-8850

Foxit Reader is affected by a JPEG2000 parsing vulnerability (CVE-2020-8850) in versions around 9.7.0.29455 and earlier. The flaw stems from insufficient validation of user-supplied data during JPEG2000 processing, causing a write past the end of an allocated structure and enabling remote code ex...

CVE-2020-8849

Foxit Reader 9.7.0.29455 (and related versions) is affected by a JPEG2000 file parsing vulnerability that can lead to remote code execution. The flaw arises from improper validation of user-supplied data, causing a write past the end of an allocated structure in JPEG2000 processing. Exploitation ...

CVE-2020-8848

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-8847

Foxit Reader 9.7.0.29455 is affected by CVE-2020-8847 due to a JPEG2000 parsing flaw that allows out-of-bounds writes in a component handling JPEG2000 data. The issue enables remote code execution and requires user interaction (visiting a malicious page or opening a malicious file). The root caus...

CVE-2020-8847

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-8848

Foxit Reader 9.7.0.29455 is affected by a JPEG2000 parsing vulnerability: a lack of input validation leads to an out-of-bounds write in processing JPEG2000 data, allowing remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The iss...

CVE-2020-8845

Foxit PhantomPDF 9.6.0.25114 is affected by a remote code execution vulnerability in the AcroForms watermark handling. The flaw stems from not validating the existence of an object before performing operations on it, enabling an attacker to run code in the process context after user interaction (...

CVE-2020-8846

CVE-2020-8846 affects Foxit PhantomPDF 9.6.0.25114 (and related) via a flaw in how text field objects are handled. The issue stems from not validating the existence of an object before performing operations, enabling an attacker to trigger remote code execution. Some records describe it as a use‑...