CVE-2020-26538: Uncontrolled Search Path Element

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the current working directory...

PT-2020-16446

Name of the Vulnerable Software and Affected Versions Foxit Reader versions prior to 10.1 PhantomPDF versions prior to 10.1 Description An issue allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the current working directory. Recommendations For Foxit Reader versions...

CVE-2020-26536: NULL Pointer Dereference

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is a NULL pointer dereference via a crafted PDF document...

PT-2020-16443

Name of the Vulnerable Software and Affected Versions Foxit Reader versions prior to 10.1 PhantomPDF versions prior to 10.1 Description An issue was discovered that leads to a write access violation and a read access violation when TslAlloc attempts to allocate thread local storage but obtains an...

CVE-2020-26540: Improper Verification of Cryptographic Signature

An issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS. Because the Hardened Runtime protection mechanism is not applied to code signing, code injection or an information leak can occur...

CVE-2020-26537: Out-of-bounds Write

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. In a certain Shading calculation, the number of outputs is unequal to the number of color components in a color space. This causes an out-of-bounds write...

PT-2020-16447

Name of the Vulnerable Software and Affected Versions Foxit Reader versions prior to 10.1 Foxit PhantomPDF versions prior to 10.1 Description An issue was discovered that can lead to a use-after-free error, potentially resulting in remote code execution or an information leak. This occurs when...

PT-2020-16445

Name of the Vulnerable Software and Affected Versions Foxit Reader versions prior to 10.1 Foxit PhantomPDF versions prior to 10.1 Description An issue was discovered in a certain Shading calculation where the number of outputs is unequal to the number of color components in a color space, causing...

CVE-2020-26534: Use After Free

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. There is an Opt object use-after-free related to Field::ClearItems and Field::DeleteOptions, during AcroForm JavaScript execution...

PT-2020-16444

Name of the Vulnerable Software and Affected Versions Foxit Reader versions prior to 10.1 Foxit PhantomPDF versions prior to 10.1 Description An issue was discovered that allows for a NULL pointer dereference via a crafted PDF document. Recommendations For Foxit Reader versions prior to 10.1,...

PT-2020-16442

Name of the Vulnerable Software and Affected Versions Foxit Reader versions prior to 10.1 PhantomPDF versions prior to 10.1 Description An issue was discovered related to an Opt object use-after-free, which occurs during AcroForm JavaScript execution. This is specifically related to the...

CVE-2020-26539: Use After Free

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. When there is a multiple interpretation error for /V in the Additional Action and Field dictionaries, a use-after-free can occur with resultant remote code execution or an information leak...

CVE-2020-26535: Out-of-bounds Write

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. If TslAlloc attempts to allocate thread local storage but obtains an unacceptable index value, V8 throws an exception that leads to a write access violation and read access violation...

Foxit PhantomPDF Information Disclosure Vulnerability (CNVD-2020-62458)

PhantomPDF is a Chinese Foxit Foxit company for enterprise-level users of PDF document processing software. An information disclosure vulnerability exists in Foxit PhantomPDF's handling of U3D objects embedded in PDF files. The vulnerability stems from improper validation of user-supplied data. A...

Foxit PhantomPDF Remote Code Execution Vulnerability (CNVD-2020-62464)

PhantomPDF is a Chinese Foxit Foxit company for enterprise-level users of PDF document processing software. A remote code execution vulnerability exists in Foxit PhantomPDF's handling of U3D objects embedded in PDF files. The vulnerability stems from a failure to properly validate the length of...

Foxit PhantomPDF Remote Code Execution Vulnerability (CNVD-2020-62459)

PhantomPDF is a Chinese Foxit Foxit company for enterprise-level users of PDF document processing software. A remote code execution vulnerability exists in Foxit PhantomPDF's handling of U3D objects embedded in PDF files. The vulnerability stems from improper validation of user-supplied data. An...

Foxit PhantomPDF Elevation of Privilege Vulnerability

PhantomPDF is a Chinese Foxit Foxit company for enterprise-level users of PDF document processing software. An elevation of privilege vulnerability exists in Foxit PhantomPDF 10.0.1.35811 and earlier versions in the handling of configuration files used by the update service. The vulnerability ste...

Foxit PhantomPDF Remote Code Execution Vulnerability (CNVD-2020-62457)

PhantomPDF is a Chinese Foxit Foxit company for enterprise-level users of PDF document processing software. A remote code execution vulnerability exists in the parsing of GIF files in Foxit PhantomPDF 10.0.1.35811 and earlier versions. The vulnerability stems from a failure to validate the...

Vulnerabilities fixed in Foxit Reader and Foxit PhantomPDF

Vulnerabilities have been fixed in Foxit Reader and Foxit PhantomPDF. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Remote code execution User Rights Access to system data Increased user privileges Foxit has...

PT-2020-14963

Name of the Vulnerable Software and Affected Versions Foxit PhantomPDF version 10.0.0.35798 Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The...