CVE-2017-10951

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2017-10951

CVE-2017-10951 affects Foxit Reader 8.x (e.g., 8.3.0.14878) and Foxit PhantomPDF prior to 8.3.2. The vulnerability arises from improper validation of a user-supplied string used in the app.launchURL JavaScript call, enabling an attacker to execute arbitrary code under the current process context....

CVE-2017-10952

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.0.2051. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the save...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of August 21, 2017

In last week’s blog entry, I mentioned the fact that the Zero Day Initiative ZDI published two zero-day advisories ZDI-17-691 and ZDI-17-692 for vulnerabilities found in Foxit Reader after Foxit failed to meet the 120-day deadline outlined in ZDI’s disclosure policy. Since the public disclosure,...

The vulnerability of the syntax analysis module of PCX files and the PDF editing programs like Adobe Acrobat, Adobe Acrobat Document Cloud, as well as PDF viewing programs like Foxit Reader, Adobe Reader Document Cloud, and Adobe Reader allows attackers to execute arbitrary code.

The vulnerability of the syntax analysis module of PCX files and the PDF editing programs such as Adobe Acrobat, Adobe Acrobat Document Cloud, as well as PDF viewing programs like Foxit Reader and Adobe Reader Document Cloud/Adobe Reader arises from an operation that goes beyond the buffer...

PDF-XChange Viewer 2.5 (Build 314.0) Code Execution

Exploit Title: PDF-XChange Viewer 2.5 Build 314.0 Javascript API Remote Code Execution Exploit Powershell PDF Exploit Creation Date: 21-08-2017 Software Link 32bit: http://pdf-xchange-viewer.it.uptodown.com/windows Exploit Author: Daniele Votta Contact: [email protected] Website:...

Foxit Reader PDF Command Injection Remote Code Execution (CVE-2017-10951)

A remote code execution vulnerability has been reported in Foxit Reader. The vulnerability is due improper validation of a string before using it to execute a system call. A remote attacker could exploit this vulnerability by enticing a user to click a maliciously crafted file. Successful...

Foxit Reader PDF Arbitrary File Write Remote Code Execution (CVE-2017-10952)

A remote code execution vulnerability has been reported in Foxit Reader. The vulnerability is due improper data validation which could lead to writing files. A remote attacker could exploit this vulnerability by enticing a user to click a maliciously crafted file. Successful exploitation could le...

Foxit to Fix PDF Reader Zero Days by Friday

In an about-face, Foxit Software says it will fix a pair of zero days in its PDF reader Foxit Reader and PhantomPDF, its PDF editing software. Foxit said it would push a patch for Reader and PhantomPDF, bringing the software to version 8.3.2, later this week—by Friday at the latest. The fixes com...

Foxit Reader command injection(CVE-2017-10951)and file writing Vulnerability(CVE-2017-10952)

A tale about Foxit Reader - Safe Reading mode and other vulnerabilities Some days ago someone send me the following link, which describes two vulnerabilities in Foxit Reader: http://thehackernews.com/2017/08/two-critical-zero-day-flaws-disclosed.html These two vulnerabilities are similar to the...

Foxit PhantomPDF < 7.3.15 Multiple Vulnerabilities

According to its version, the Foxit PhantomPDF application formally known as Phantom installed on the remote Windows host is prior to 7.3.15. It is, therefore, affected by multiple vulnerabilities : - An unspecified NULL pointer dereference flaw allows an unauthenticated, remote attacker to cause...

Foxit Reader Arbitrary Code Execution Vulnerability (CNVD-2017-28760)

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. An arbitrary code execution vulnerability exists in Foxit Reader. A remote attacker can exploit this vulnerability by creating a specially crafted JPEG2000 file to execute arbitrary code on the target system...

Foxit Reader Arbitrary Code Execution Vulnerability (CNVD-2017-28759)

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. An arbitrary code execution vulnerability exists in Foxit Reader. A remote attacker can exploit this vulnerability by creating a specially crafted JPEG2000 file to execute arbitrary code on the target system...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of August 14, 2017

One of my favorite movies is the 1999 comedy “Galaxy Quest,” which features the cast of a science-fiction television series similar to Star Trek. In the movie, the crew is visited by real aliens who ask them for help against an intergalactic adversary because they believe that Galaxy Quest is a...

Foxit PDF reader there 2 at high-risk vulnerabilities, the vendor has refused to fix? - Vulnerability warning-the black bar safety net

Use Foxit Foxit PDF reader's user to pay special attention to the security researchers which discovered two serious 0day vulnerability, such as not the reader is configured in the secure read mode open file, it would let the attacker on the target computer to execute arbitrary code. Foxit company...

Two Critical Zero-Day Flaws Disclosed in Foxit PDF Reader

Are you using Foxit PDF Reader? If yes, then you need to watch your back. Security researchers have discovered two critical zero-day security vulnerabilities in Foxit Reader software that could allow attackers to execute arbitrary code on a targeted computer, if not configured to open files in th...

Foxit PDF Compressor installers DLL loading remote code execution vulnerability

Foxit PDF Compressor is China's Foxit Foxit Software Corporation of a PDF document compression tool. Foxit PDF Compressor installers is one of the installation program. A security vulnerability exists in Foxit PDF Compressor installers versions 7.0.0.183 through 7.7.2.10. A remote attacker can...

(0Day) Foxit Reader launchURL Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within app.launchURL metho...

KLA11093 Arbitrary code execution vulnerabilities in Foxit Reader

Multiple serious vulnerabilities have been found in Foxit Reader and Foxit PhantomPDF. Malicious users can exploit these vulnerabilities to execute arbitrary code. Below is a complete list of vulnerabilities: 1. An improper validation of user-supplied data in the saveAs Java script function can b...

(0Day) Foxit Reader saveAs Arbitrary File Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the saveAs JavaScri...