PT-2009-3318 · Foxit · Foxit Jpeg2000/Jbig2 Decoder Add-On+1

Will Dormann · Publicado 2009-06-23 · Atualizado 2009-06-24 · CVE-2009-0690

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Foxit Reader versions 3.0 before Build 1817 Foxit JPEG2000/JBIG2 Decoder add-on versions before 2.0.2009.616

Description The issue arises from improper handling of a negative value for the stream offset in a JPEG2000 stream, leading to potential memory corruption and application crash, or possibly allowing execution of arbitrary code. This can be triggered by a crafted PDF file that causes an out-of-bounds read.

Recommendations For Foxit Reader version 3.0 before Build 1817, update the Foxit JPEG2000/JBIG2 Decoder add-on to version 2.0.2009.616 or later. For Foxit JPEG2000/JBIG2 Decoder add-on versions before 2.0.2009.616, update to version 2.0.2009.616 or later.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2009-0690

Produtos afetados

Foxit Jpeg2000/Jbig2 Decoder Add-On

Foxit Reader

Referências · 7

• http://securityfocus.com/bid/35442 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/1640 · Aviso do Fabricante
• http://secunia.com/advisories/35512 · Aviso do Fabricante
• http://foxitsoftware.com/pdf/reader/security.htm#0602 · Aviso do Fabricante
• http://securitytracker.com/id?1022425 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0690 · Nota de Segurança
• http://kb.cert.org/vuls/id/251793 · Nota