CVE-2017-8454

CVE-2017-8454 affects Foxit Reader before 8.2.1 and Foxit PhantomPDF before 8.2.1. The vulnerability is an out-of-bounds read triggered by a crafted font in a PDF, allowing remote attackers to obtain sensitive information or potentially execute arbitrary code. Connected sources corroborate the im...

CVE-2018-10473

CVE-2018-10473 affects Foxit Reader 9.0.0.29935 and is due to improper validation in the parsing of U3D CLOD Base Mesh Continuation structures, causing an out-of-bounds write that can execute arbitrary code. The vulnerability permits remote code execution and requires user interaction (visiting a...

CVE-2018-10481

Foxit Reader 9.0.0.29935 is affected by an out-of-bounds read vulnerability in the U3D Texture Resource parsing path. The flaw stems from insufficient validation of user-supplied data, which can cause a read past the end of an allocated data structure and enable sensitive information disclosure. ...

CVE-2018-14259

CVE-2018-14259 is a type-confusion remote-code-execution vulnerability in Foxit Reader (affecting 9.0.1.1049). The flaw resides in getPageNthWordQuads and can be triggered via JavaScript when a user opens a malicious file or visits a crafted page, allowing code execution in the current process co...

CVE-2018-14316

Foxit Reader vulnerability CVE-2018-14316 affects Foxit Reader 9.0.1.5096 where PDF processing lacks proper validation, causing a read past the end of an allocated buffer. This enables remote code execution in the context of the current process and requires user interaction (visiting a malicious ...

CVE-2018-17622

CVE-2018-17622 affects Foxit Reader 9.1.0.5096 (Windows). The issue is a buffer over-read in handling Calculate events caused by improper validation of user-supplied data, allowing remote attackers to disclose sensitive information and potentially execute code in the context of the current proces...

CVE-2018-17669

CVE-2018-17669 affects Foxit Reader 9.2.0.9297 (Windows). The flaw is in the handling of the name property of an XFA object and stems from not validating the existence of the object before performing operations, enabling remote code execution with current-process privileges after user visits a ma...

CVE-2018-17700

CVE-2018-17700 affects Foxit PhantomPDF 9.2.0.9297 (Windows). The root cause is a flaw in handling of Array.prototype.concat due to insufficient validation of user-supplied data, allowing a read past the end of an allocated object. This leads to remote code execution in the context of the current...

CVE-2018-17781

Foxit PhantomPDF and Foxit Reader are affected: versions before 9.3 are vulnerable to an Uninitialized Object Information Disclosure caused by mishandling ArrayBuffer and DataView object creation. This allows remote attackers to obtain information without user interaction. No remediation details ...

CVE-2018-21242

CVE-2018-21242 affects Foxit PhantomPDF prior to 8.3.6, allowing Remote Code Execution via GoToE or GoToR actions. The issue concerns the handling of GoTo actions that can trigger code execution, with impacted versions before 8.3.6. CVSS results in the connected data show a high impact (C/H/I/A =...

CVE-2018-3996

CVE-2018-3996 concerns Foxit PDF Reader’s JavaScript engine. The vulnerability is a use-after-free in version 9.2.0.9297 that can be triggered by a crafted PDF document, allowing arbitrary code execution by reusing a freed object. An attacker must entice the user to open the malicious file; if a ...

CVE-2018-5678

Foxit Reader/PhantomPDF before 9.1 are affected by CVE-2018-5678 due to a flaw in processing PDFs with embedded u3d images, causing a heap-based buffer overflow. An attacker can exploit this via a malicious PDF to execute arbitrary code in the current process; user interaction is required (visiti...

CVE-2018-9942

The CVE-2018-9942 entry concerns Foxit Reader (v9.0.0.29935) and the XFA record removal path. The connected sources confirm a type-confusion vulnerability that enables remote code execution in the context of the current process. Exploitation requires user interaction (visiting a malicious page or...

CVE-2019-6752

Foxit PhantomPDF flaw CVE-2019-6752: in Foxit PhantomPDF 9.3.10826, parsing of PDF documents allows read past end of an allocated object, enabling information disclosure. Remote attacker must persuade target to open a malicious page/file and may leverage this with other vulnerabilities to execute...

CVE-2021-27262

CVE-2021-27262 affects Foxit PhantomPDF 10.1.0.37527. The root cause is improper validation of data in U3D object handling within PDFs, causing an out-of-bounds read that can disclose sensitive information. The vulnerability enables information disclosure and, in combination with other flaws, cou...

CVE-2021-27265

CVE-2021-27265 affects Foxit PhantomPDF 10.1.0.37527. The flaw arises from improper validation in the handling of U3D objects in PDF files, causing an out-of-bounds read (read past end of an allocated object). Exploitation requires user interaction (target visits a malicious page or opens a malic...

CVE-2018-10484

Foxit Reader 9.0.0.29935 is affected by CVE-2018-10484. The vulnerability stems from parsing U3D Node objects and is caused by a pointer that is not properly initialized before use, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a mali...

CVE-2018-10486

Foxit Reader 9.0.0.29935 is affected by an out-of-bounds read in the U3D Image Index parsing, allowing remote disclosure of sensitive information. The issue arises from improper validation of user-supplied data and requires user interaction (visiting a malicious page or opening a malicious file)....

CVE-2018-10491

Foxit Reader 9.0.0.29935 is affected by CVE-2018-10491 due to an out-of-bounds write in the parsing of U3D Bone Weight Modifier structures, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The vulnerability context is ...

CVE-2018-10494

Foxit Reader 9.0.1.1049 is affected by a stack-based buffer overflow in the parsing of U3D 3DView objects. The issue stems from insufficient validation of the length of user-supplied data before copying to a fixed-length stack buffer, enabling remote code execution under the process context. Expl...

CVE-2018-11621

Foxit Reader (Windows) vulnerability CVE-2018-11621 affects Foxit Reader 9.0.1.1049 with the ConvertToPDF_x86.dll causing an out-of-bounds read that discloses sensitive information. Exploitation requires user interaction (visiting a malicious page or opening a malicious file); an attacker could l...

CVE-2018-11623

CVE-2018-11623 affects Foxit Reader 9.0.1.1049 where the vulnerability is in the addAdLayer method, causing a type-confusion condition that allows remote code execution when a user visits a malicious page or opens a malicious file, with user interaction required. The issue is documented in ZDI-18...

CVE-2018-1174

CVE-2018-1174 affects Foxit Reader 9.0.0.29935 and is tied to the PrintParams bitmapDPI object. The root cause is uninitialized memory access in that handling, enabling information disclosure. Exploitation requires user interaction (visiting a malicious page or opening a malicious file) and, in c...

CVE-2018-1175

CVE-2018-1175 affects Foxit Reader 9.0.0.29935. The flaw is in the handling of the interactive attribute of PrintParams objects, arising from lack of proper memory initialization. This leads to information disclosure, with remote attackers able to access sensitive data; exploitation requires user...

CVE-2018-1176

Foxit Reader 9.0.0.29935 is affected by an ePub parsing vulnerability that allows remote code execution via a write past the end of an allocated object due to insufficient input validation. The issue can be triggered when a user visits a malicious page or opens a malicious file, requiring user in...

CVE-2018-14261

CVE-2018-14261 refers to a type-confusion vulnerability in Foxit Reader’s getTemplate method that enables remote code execution when a user opens a malicious file or visits a crafted page. The entry specifies that exploitation requires user interaction and can execute code with the current proces...

CVE-2018-14268

Foxit Reader CVE-2018-14268 is a type-confusion remote code execution in the mailForm method of Foxit Reader (9.0.1.1049 and earlier). Exploitation requires user interaction (visiting a malicious page or opening a crafted file). The flaw enables code execution under the current process context an...

CVE-2018-14287

Foxit Reader (v9.0.1.1049) is affected by CVE-2018-14287 due to a type confusion in the handling of arguments passed to instanceManager.nodes.append. The flaw allows remote code execution with user interaction required (visiting a malicious page or opening a crafted file). Exploitation context is...

CVE-2018-14289

CVE-2018-14289 affects Foxit Reader, including version 9.0.1.5096, with an out-of-bounds read in PDF document parsing that can disclose sensitive information. The vulnerability requires user interaction (visiting a malicious page or opening a malicious file) and can be leveraged with other issues...

CVE-2018-14294

CVE-2018-14294 affects Foxit Reader; vulnerable component is the processing of FileAttachment annotations. An attacker can craft a document to trigger a use-after-free, enabling remote code execution in the current process after user opens a malicious file or visits a malicious page. Impact is re...

CVE-2018-14298

CVE-2018-14298 affects Foxit Reader up to 9.0.1.5096 (Windows). The flaw is a use-after-free in Ink annotations processing, allowing arbitrary code execution when a user opens a poisoned document or visits a malicious page. Root cause: pointer reuse after free during document element manipulation...

CVE-2018-14299

CVE-2018-14299 affects Foxit Reader prior to 9.2.0.9097, due to a Line annotations processing flaw that allows use-after-free; remote code execution is possible with attacker-controlled document elements and user interaction. Exploitation is described in multiple advisories (ZDI-18-759, CNVD-2018...

CVE-2018-17615

Foxit Reader for Windows vulnerability CVE-2018-17615 affects Foxit Reader 9.0.1.5096. The flaw lies in Mouse Exit event handling and stems from not validating the existence of an object before performing operations, enabling remote code execution. Exploitation requires user interaction (visiting...

CVE-2018-17625

CVE-2018-17625 affects Foxit Reader (Windows). The flaw is a use-after-free/memory misreference in handling the JavaScript setInterval() method where the code fails to verify object existence before operations, enabling remote code execution in the context of the current process. User interaction...

CVE-2018-17652

CVE-2018-17652 affects Foxit Reader 9.2.0.9297 (Windows). The flaw is in the XFA TimeField mandatory property handling, caused by not validating the existence of an object before performing operations, which enables a remote attacker to execute code in the context of the current process via a cra...

CVE-2018-17663

Foxit Reader 9.2.0.9297 is affected by CVE-2018-17663 due to a memory misreference in the Host.importData path. The flaw stems from not validating the existence of an object before performing operations on it, allowing remote code execution when a user visits a malicious page or opens a malicious...

CVE-2018-17682

Foxit Reader (Windows) 9.2.0.9297 and earlier is affected by CVE-2018-17682 due to a use-after-free/memory misreference in the handling of the delay property of Annotation objects. The flaw allows remote code execution in the context of the current process when a user opens a malicious file/page ...

CVE-2018-17683

Foxit Reader 9.2.0.9297 (and earlier per CNVD) is affected by a vulnerability in the createIcon handling of an app object. The flaw is a lack of validation for object existence before operations, leading to remote code execution. User interaction is required (visiting a malicious page or opening ...

CVE-2018-17687

CVE-2018-17687 affects Foxit PhantomPDF (notably version 9.2.0.9297) and relates to the exportValues handling of a radio button. The flaw arises from not validating the existence of an object before performing operations, enabling remote code execution via a malicious page or file. Exploitation r...

CVE-2018-17689

CVE-2018-17689 affects Foxit PhantomPDF (and related Foxit viewer components) with a remote code execution flaw in the fillColor handling of a radio button. The root cause is lack of object existence validation before operations, enabling code execution in the current process after user interacti...

CVE-2018-17694

CVE-2018-17694 affects Foxit PhantomPDF 9.2.0.9297 (and related Foxit PDF products in some feeds) with a display-property handling flaw in a button where the program does not verify an object’s existence before acting. This leads to remote code execution in the context of the current process, wit...

CVE-2018-17696

Foxit Reader 9.2.0.9297 (and earlier) is affected by a dataObjects handling vulnerability that fails to validate object existence before operations, enabling remote code execution when a user opens a malicious file or visits a malicious page. The flaw allows code to run in the context of the curr...

CVE-2018-9954

Foxit Reader 9.0.1.1049 is affected by CVE-2018-9954 due to a flaw in handling XFA Button elements. The bug occurs when setting the y attribute, where the code does not properly validate the existence of an object before operating on it, enabling remote code execution under the process context. E...

CVE-2019-20818

CVE-2019-20818 affects Foxit Reader and PhantomPDF prior to version 9.7. The issue is a resource-management vulnerability where data is created for each page at the application level, leading to memory consumption. The supplied documents describe the affected products and the root cause but do no...

CVE-2019-20828

CVE-2019-20828 affects Foxit Reader and PhantomPDF prior to version 9.6. The vulnerability is a buffer overflow caused by a looping correction that does not occur after JavaScript updates Field APs, leading to potential memory corruption. Multiple sources corroborate the issue across vendor advis...

CVE-2019-20836

Foxit Reader and Foxit PhantomPDF prior to 9.5 are affected by a cloud credentials mishandling vulnerability. Multiple sources (including CNVD-2020-32457, RH/CVE-2019-20836, NVD, CNVD, and others) describe an issue where cloud credentials are mishandled, demonstrated via Google Drive, potentially...

CVE-2019-6727

CVE-2019-6727 involves Foxit Reader (XFA remerge method) where a failure to validate the existence of an object before operating on it enables remote code execution after user visits a malicious page or opens a malicious file. The issue is characterized as a use-after-free/invalid object handling...

CVE-2019-6728

The CVE-2019-6728 issue affects Foxit Reader (PDF processing path) and is due to an out-of-bounds read caused by inadequate validation of user-supplied data, resulting in a read past the end of an allocated buffer. This vulnerability can disclose sensitive information and, in conjunction with oth...

CVE-2019-6732

Foxit PhantomPDF (and Foxit Reader) is affected by CVE-2019-6732 due to improper validation in AFParseDateEx, causing an out-of-bounds read that can disclose sensitive information. The vulnerability requires user interaction (visiting a malicious page or opening a malicious file) and can be trigg...

CVE-2020-13807

The vulnerability CVE-2020-13807 affects Foxit Reader and PhantomPDF up to version 9.7.2, caused by circular-reference mishandling that can produce a loop. Documented details specify the affected products and the root cause as circular references, with an impact description indicating a loop, but...