Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Foxit PDF Reader

Aleksandar Nikolic of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered four remote code execution vulnerabilities in Foxit PDF Reader. Foxit PDF Reader is a popular program for reading and editing PDFs. The software supports JavaScript to allow fo...

PT-2020-11069

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader version 9.7.0.29435 Description A use-after-free issue in the JavaScript engine of Foxit PDF Reader can be exploited, allowing arbitrary code execution when a specially crafted PDF document is opened. This can happen when a us...

PT-2020-11071

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader version 9.7.0.29435 Description A use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader. This issue can be triggered by a specially crafted PDF document, allowing a previously freed object in memory ...

PT-2020-11070

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader version 9.7.0.29435 Description A use-after-free issue in the JavaScript engine of Foxit PDF Reader can be triggered by a specially crafted PDF document, potentially leading to arbitrary code execution. An attacker must trick...

PT-2020-11074

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader version 9.7.0.29435 Description An exploitable use-after-free issue exists in the JavaScript engine. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code...

CVE-2019-5145: Use After Free

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open t...

CVE-2019-5130: Use After Free

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick th...

CVE-2019-5131: Use After Free

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick t...

CVE-2019-5126: Use After Free

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open t...

KLA11648 Multiple vulnerabilities in Foxit PDF Reader

A multiple use-after-free vulnerabilities in the JavaScript engine can be exploited by a specially crafted PDF document to execute arbitrary code. Original advisories Foxit Security Bulletins Exploitation Public exploits exist for this vulnerability. Related products Foxit-Reader Foxit-Phantom-PD...

Foxit PDF Reader JavaScript field keystroke action remote code execution vulnerability

Summary An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user t...

Foxit PDF Reader Javascript createTemplate Invalid Page Code Execution Vulnerability

Summary An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to...

Foxit PDF Reader Javascript Field Action Validate Remote Code Execution Vulnerability

Summary An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to...

Foxit PDF Reader JavaScript field action OnBlur remote code execution vulnerability

Summary An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to...

CVE-2019-19819

The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NULL Pointer Dereference via crafted Unicode content...

CVE-2019-19819

The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NULL Pointer Dereference via crafted Unicode content...

CVE-2019-19817

The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out-of-Bounds Read via crafted Unicode content...

Out-of-bounds

The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out-of-Bounds Read via crafted Unicode content...

Null pointer dereference

The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NULL Pointer Dereference via crafted Unicode content...

Nitro Software Free PDF Reader Buffer Error Vulnerability

Nitro Software Free PDF Reader is a set of free PDF document editor from Nitro Software, USA. The product is mainly used to create, edit, view and convert PDF documents. A JBIG2Decode stock-in-buffer error vulnerability exists in the npdf.dll file in Nitro Software Free PDF Reader version...