CVE-2018-17678

Foxit Reader 9.2.0.9297 is affected by a remote code execution vulnerability in the gotoNamedDest handling of the app object. The flaw arises from not validating the existence of an object before performing operations, enabling code execution in the context of the current process when a user open...

CVE-2018-17632

Foxit Reader 9.2.0.9297 is affected by CVE-2018-17632. The flaw lies in the resolveNode handling, where lack of validation of an object before operations leads to a use-after-free condition, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or openi...

CVE-2018-17634

CVE-2018-17634 affects Foxit Reader 9.2.0.9297 and earlier; the vulnerability is a use-after-free in the attachIcon handling of Annotation objects, caused by not validating the existence of an object before operations. Remote code execution is possible with user interaction (visit a malicious pag...

CVE-2018-17637

Foxit Reader (Windows) vulnerable: Foxit Reader 9.2.0.9297 and earlier exposes a flaw in loadXML handling within the XFA object, where the code fails to validate the existence of an object before performing operations. This results in a use-after-free/memory misreference type condition that can a...

CVE-2018-17654

Foxit Reader on Windows (versions up to 9.2.0.9297) is affected by a vulnerability in the XFA Form Model insertInstance handling. The flaw is a use-after-free due to lack of validating object existence before operations, enabling remote code execution if a user opens a malicious file or visits a ...

CVE-2018-17691

CVE-2018-17691 affects Foxit PhantomPDF (9.2.0.9297 and likely earlier); the issue arises in the HTML-to-PDF conversion when the software fails to validate an object’s existence before performing operations. This use-after-free style flaw enables remote code execution with the attacker hosting a ...

CVE-2018-17689

CVE-2018-17689 affects Foxit PhantomPDF (and related Foxit viewer components) with a remote code execution flaw in the fillColor handling of a radio button. The root cause is lack of object existence validation before operations, enabling code execution in the current process after user interacti...

CVE-2018-17628

Foxit Reader (Windows) 9.2.0.9297 and earlier versions are affected by CVE-2018-17628. The flaw occurs in the XFA setInterval method due to not validating the existence of an object before performing operations, enabling remote code execution when a user opens a malicious file or visits a crafted...

CVE-2018-17648

Foxit Reader (Windows) vulnerability CVE-2018-17648 affects Foxit Reader 9.2.0.9297 and enables remote code execution via the TimeField rotate property after an object existence check fails. Attack requires user interaction (visit a malicious page or open a malicious file). Connected sources (e.g...

CVE-2018-17655

CVE-2018-17655 affects Foxit Reader (Windows) 9.2.0.9297 and earlier, with multiple sources confirming a moveInstance handling flaw in Form objects. The root cause is the failure to validate object existence before performing operations, enabling remote code execution. Attack requires user intera...

CVE-2018-17652

CVE-2018-17652 affects Foxit Reader 9.2.0.9297 (Windows). The flaw is in the XFA TimeField mandatory property handling, caused by not validating the existence of an object before performing operations, which enables a remote attacker to execute code in the context of the current process via a cra...

CVE-2018-17705

CVE-2018-17705 affects Foxit Reader 9.2.0.9297 and earlier. The vulnerability arises from the handling of the display property of CheckBox objects, due to not validating the existence of an object before performing operations, enabling remote code execution via a malicious page or file with user ...

CVE-2018-17695

CVE-2018-17695 affects Foxit PhantomPDF (notably version 9.2.0.9297 and earlier per CNVD) where a use-after-free/memory misreference in the TextField username handling allows remote code execution. The flaw arises from not validating object existence before operations, enabling an attacker to run...

CVE-2018-17693

This CVE concerns Foxit PhantomPDF 9.2.0.9297 and earlier on Windows, where the HTML to PDF conversion path can trigger an out-of-bounds read due to improper validation of user-supplied HTML data. The vulnerability allows remote code execution in the context of the current process and requires us...

CVE-2018-17697

Foxit Reader 9.2.0.9297 and earlier are affected by a templates handling vulnerability where code executes due to a missing object existence check, enabling remote code execution after user opens a malicious page/file. Exploitation requires user interaction; advisory ZDI-18-1215 describes a use-a...

CVE-2018-17627

Foxit Reader/PhantomPDF for Windows (Foxit Reader 9.2.0.9297 and earlier) contains a vulnerability in the XFA mouseUp handling that can trigger a use-after-free, allowing remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). Affecte...

CVE-2018-17650

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17647

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17655

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17657

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...