Kamlapati Choubey

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 12.1.2.15356 **Description** A use-after-free issue exists in the way Foxit Reader handles 3D annotations. This can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory corruption and potentially allowing an attacker to execute arbitrary code. An attacker needs to trick the user into opening the malicious file to trigger this issue. Exploitation is also possible if a user visits a specially crafted, malicious site when the browser plugin extension is enabled. **Recommendations** For Foxit Reader version 12.1.2.15356, consider disabling the handling of 3D annotations or the browser plugin extension as a temporary workaround until a patch is available. Avoid opening malicious PDF files or visiting suspicious websites with the browser plugin enabled to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 12.1.3.15356 **Description** A code execution issue exists in the Javascript saveAs API of Foxit Reader. This is due to the improper handling of specially crafted malformed files, which can lead to the creation of arbitrary files and potentially result in remote code execution. An attacker must trick the user into opening a malicious file to exploit this issue. Additionally, exploitation is possible if a user visits a specially crafted malicious site when the browser plugin extension is enabled. **Recommendations** For Foxit Reader version 12.1.3.15356, consider disabling the Javascript saveAs API until a patch is available to prevent potential code execution. Restrict access to malicious sites and avoid opening untrusted files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Foxit PDF Reader versions 12.1.3.15356 **Description** The issue is related to errors in processing hyperlinks and mistreatment of whitespace characters in the Javascript exportDataObject API. This can allow a remote attacker to execute arbitrary code. A specially crafted malicious file can create files at arbitrary locations, leading to code execution. Exploitation is possible if a user opens the malicious file or visits a specially crafted site with the browser plugin extension enabled. **Recommendations** For version 12.1.3.15356, consider disabling the Javascript exportDataObject API until a patch is available. Restrict access to the browser plugin extension to minimize the risk of exploitation. Avoid opening suspicious files or visiting untrusted sites with the browser plugin extension enabled. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit PDF Reader versions 12.1.2.15356 **Description** The issue is related to a type confusion vulnerability in the way Foxit Reader handles field value properties. This can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory corruption and potentially allowing an attacker to execute arbitrary code. An attacker can exploit this by tricking a user into opening a malicious file or by having the user visit a specially crafted malicious site if the browser plugin extension is enabled. **Recommendations** For Foxit PDF Reader version 12.1.2.15356, consider disabling the browser plugin extension to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid opening PDF files from untrusted sources to reduce the risk of triggering the vulnerability. Restrict access to malicious sites to prevent potential exploitation through the browser. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 12.1.3.15356 **Description** The issue is related to the exportDataObject API in Foxit Reader, which fails to properly validate a dangerous extension, leading to an arbitrary file creation vulnerability. This can allow an attacker to create files at arbitrary locations, potentially resulting in arbitrary code execution. The exploitation can occur if a user opens a specially crafted malicious file or visits a malicious site with the browser plugin extension enabled. **Recommendations** For Foxit Reader version 12.1.3.15356, consider disabling the exportDataObject API function until a patch is available to prevent potential exploitation. Restrict access to the Javascript exportDataObject API to minimize the risk of arbitrary file creation. Avoid opening suspicious files or visiting untrusted sites with the browser plugin extension enabled until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat Reader versions 23.006.20360 and earlier Adobe Acrobat Reader versions 20.005.30524 and earlier Adobe Acrobat 2020 Adobe Acrobat Reader 2020 **Description** The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file. This allows an attacker to execute arbitrary code. **Recommendations** For Adobe Acrobat Reader versions 23.006.20360 and earlier, update to a version later than 23.006.20360 to resolve the issue. For Adobe Acrobat Reader versions 20.005.30524 and earlier, update to a version later than 20.005.30524 to resolve the issue. For Adobe Acrobat 2020 and Adobe Acrobat Reader 2020, consider disabling the use of memory allocation functions until a patch is available. As a temporary workaround, avoid opening malicious files with Adobe Acrobat Reader until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Foxit PDF Reader version 12.1.2.15332 **Description** A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. **Recommendations** For Foxit PDF Reader version 12.1.2.15332, consider disabling the JavaScript engine in the PDF Reader as a temporary workaround until a patch is available. Restrict access to malicious sites and avoid opening suspicious PDF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 12.1.2.15332 **Description** A use-after-free vulnerability exists in the way Foxit Reader handles destroying annotations. Specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. **Recommendations** For Foxit Reader version 12.1.2.15332, consider disabling the browser plugin extension to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid opening malicious PDF documents or visiting specially crafted, malicious sites. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit PDF Reader version 12.1.2.15332 **Description** A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. **Recommendations** For Foxit PDF Reader version 12.1.2.15332, consider disabling the JavaScript engine in the PDF Reader as a temporary workaround until a patch is available. Restrict access to malicious PDF files and avoid visiting untrusted websites with the browser plugin extension enabled. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 12.1.2.15332 Foxit PDF Editor (affected versions not specified) **Description** A type confusion vulnerability exists in the Javascript `checkThisBox` method. Specially crafted Javascript code inside a malicious PDF document can cause memory corruption and lead to remote code execution. The user would need to open a malicious file to trigger the issue. The vulnerability can be exploited by a remote attacker using a specially created PDF file. **Recommendations** For Foxit Reader version 12.1.2.15332, consider disabling the `checkThisBox` method until a patch is available. For Foxit PDF Editor, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a lack of protection for sensitive data in the Windows GDI component, allowing an attacker to disclose protected information using a specially crafted document. This can enable attackers to obtain sensitive information and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers **Description** The issue is related to an information disclosure vulnerability in the Windows GDI component, which improperly discloses the contents of its memory. This can be exploited by attackers to obtain sensitive information using a specially crafted document. The vulnerability is associated with errors in the mechanisms for handling objects in memory. **Recommendations** For Windows 7, consider applying configuration changes to restrict access to sensitive information until a patch is available. For Windows Server 2012 R2, restrict access to the GDI component to minimize the risk of exploitation. For Windows RT 8.1, avoid using specially crafted documents that could trigger the vulnerability. For Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 9.2.0.9297 **Description** This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of the `subject` property of `Annotation` objects due to the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process. **Recommendations** For Foxit Reader version 9.2.0.9297, consider disabling the handling of `Annotation` objects until a patch is available. Restrict access to potentially malicious files and web pages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 9.2.0.9297 **Description** This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of the `createIcon` method of an `app` object, resulting from the lack of validation of an object's existence prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process. **Recommendations** For Foxit Reader version 9.2.0.9297, as a temporary workaround, consider disabling the `createIcon` method of the `app` object until a patch is available. Restrict access to potentially malicious files and web pages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 9.2.0.9297 **Description** This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of the `delay` property of `Annotation` objects, resulting from the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process. **Recommendations** For Foxit Reader version 9.2.0.9297, consider disabling the handling of `Annotation` objects until a patch is available. Restrict access to potentially malicious pages or files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 9.2.0.9297 **Description** This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of the `attachIcon` property of `Annotation` objects, due to the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process. **Recommendations** For Foxit Reader version 9.2.0.9297, update to a version that fixes the issue with the `attachIcon` property of `Annotation` objects to prevent remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.