PT-2016-5834 · Microsoft+1 · Gflags+3

Abdulaziz Hariri · Publicado 2016-03-23 · Atualizado 2016-11-08 · CVE-2016-4065

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit Reader and PhantomPDF versions prior to 7.3.4

Description The issue allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted image, including JPEG, GIF, or BMP formats. This occurs when the gflags app is enabled.

Recommendations For Foxit Reader and PhantomPDF versions prior to 7.3.4, update to version 7.3.4 or later to resolve the issue. As a temporary workaround, consider disabling the ConvertToPDF plugin until a patch is available. Restrict access to the ConvertToPDF functionality to minimize the risk of exploitation. Avoid using the ConvertToPDF plugin with untrusted image files, including JPEG, GIF, and BMP formats, until the issue is resolved.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-4065

ZDI-16-216

ZDI-16-217

ZDI-16-218

Produtos afetados

Converttopdf

Foxit Reader

Phantompdf

Gflags

Referências · 9

• http://zerodayinitiative.com/advisories/ZDI-16-217 · Nota
• https://zerodayinitiative.com/advisories/ZDI-16-218 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-4065 · Nota de Segurança
• https://foxitsoftware.com/support/security-bulletins.php · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-16-216 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-16-216 · Nota
• https://zerodayinitiative.com/advisories/ZDI-16-217 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-16-218 · Nota
• https://osv.dev/vulnerability/CVE-2016-4065 · Aviso do Fabricante