CVE-2020-8852

CVE-2020-8852 affects Foxit Reader 9.7.0.29455 (and related records) with an out-of-bounds read in JPEG2000 file processing that can disclose sensitive information. Root cause: insufficient validation of user-supplied data leading to a read past the end of an allocated buffer. Attack requires use...

CVE-2020-10901

CVE-2020-10901 affects Foxit PhantomPDF 9.7.1.29511. The vulnerability lies in U3D object handling in PDF files and results from insufficient validation of user-supplied data, causing a read past the end of an allocated object. It enables remote information disclosure and, when combined with othe...

CVE-2020-15637

The CVE-2020-15637 entry concerns Foxit PhantomPDF (and related Foxit products) with a use-after-free flaw in SetLocalDescription that can disclose sensitive information. Exploitation requires user interaction (visiting a malicious page or opening a malicious file) and is described as a local/vec...

CVE-2020-10903

CVE-2020-10903 affects Foxit PhantomPDF 9.7.1.29511, where U3D objects in PDFs are not properly validated, causing an out-of-bounds read that can disclose sensitive data. The issue requires user interaction (visiting a malicious page or opening a malicious file) and, in combination with other vul...

CVE-2020-10894

The CVE-2020-10894 issue affects Foxit PhantomPDF 9.7.1.29511 (U3D object handling) and is caused by insufficient validation of user-supplied data, leading to a read past the end of an allocated object (out-of-bounds read). This enables remote information disclosure with user interaction required...

CVE-2020-10905

CVE-2020-10905 affects Foxit PhantomPDF 9.7.1.29511. The issue is an out-of-bounds read in U3D vertex handling due to insufficient validation, requiring user interaction (malicious page/file) and potentially enabling code execution when combined with other vulnerabilities. Multiple sources (ZDI-2...

CVE-2019-20835

Foxit Reader and PhantomPDF prior to 9.5 are affected by a homograph mishandling issue. CVSSv3.1 base score 4.3 (NETWORK attack, USER INTERACTION required; I=LOW) per provided records. No explicit root cause, exploit details, or remediation are stated in the documents; no detailed impact beyond t...