CVE-2018-19447

Foxit PDF SDK ActiveX vulnerability CVE-2018-19447 affects Foxit Reader SDK ActiveX Std/Pro 5.4.0.1031, where parsing URI strings can trigger a stack-based buffer overflow, enabling remote code execution. Root cause: unchecked URI parsing in the ActiveX component. Reported impact: remote code exe...

CVE-2018-19444

CVE-2018-19444 describes a use-after-free in the TextBox Validate action of IReader_ContentProvider within Foxit Reader SDK ActiveX Professional 5.4.0.1031. Exploitation via specially crafted PDFs can lead to remote code execution. The Red Hat and CVE mappings note this vulnerability is distinct ...

CVE-2018-19450

CVE-2018-19450 affects Foxit Reader SDK ActiveX: a command-injection bug occurs when parsing a Launch action in specially crafted PDF files, enabling remote code execution. Affected: Foxit Reader SDK ActiveX prior to 5.5.1 (e.g., 5.4.0.1031). Exploitation requires user interaction. Vendor guidanc...

CVE-2018-19446

CVE-2018-19446 affects Foxit Reader SDK ActiveX Pro (5.4.0.1031). The vulnerability lies in the JavaScript API Doc.createDataObject, which can cause a File Write when processing specially crafted PDFs, enabling remote code execution. According to the connected SRCINCITE entry, exploitation requir...

CVE-2018-19448

The CVE-2018-19448 vulnerability affects Foxit Reader SDK ActiveX Pro, where an uninitialized pointer in IReader_ContentProvider::GetDocEventHandler can be triggered when the ActiveX control is embedded in Office documents, allowing remote code execution. Exploitation requires user interaction (e...

CVE-2018-19449

Foxit Reader SDK ActiveX Pro (affected versions up to 5.4.0.1031; blocks indicate 5.5.1 and earlier) contains a file write vulnerability in the JavaScript API Doc.exportAsFDF that can lead to remote code execution when processing specially crafted PDFs. The issue stems from insufficient validatio...

CVE-2018-19445

CVE-2018-19445 affects Foxit Reader SDK ActiveX Pro (5.4.0.1031) where the JavaScript API app.launchURL can be abused to inject commands, enabling remote code execution. The root cause is insufficient validation of user-supplied strings before executing them via a system call in the ActiveX compo...

CVE-2018-19452

CVE-2018-19452 and related entries describe a use-after-free vulnerability in Foxit Reader SDK ActiveX (Professional 5.4.0.1031). The issue occurs in the IReader_ContentProvider when a Mouse Enter action triggers a use-after-free on the TextBox field, allowing remote code execution. The Red Hat/N...

CVE-2018-19451

Foxit Reader SDK ActiveX Pro (pre-5.5.1, e.g., 5.4.0.1031) is affected by CVE-2018-19451: a command injection via the Open File action on a Field can lead to remote code execution. The issue stems from inadequate validation when using a user-supplied string to invoke system calls. Exploitation re...