PT-2018-16237 · Foxit · Foxit Pdf Reader

Publicado 2018-04-19 · Atualizado 2023-02-03 · CVE-2018-3843

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader version 9.0.1.1049

Description A type confusion issue exists in the way Foxit PDF Reader parses files with associated file annotations. This can be triggered by a specially crafted PDF document, potentially leading to sensitive memory disclosure and possibly arbitrary code execution. An attacker must trick the user into opening the malicious file to exploit this issue. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Recommendations For Foxit PDF Reader version 9.0.1.1049, consider disabling the browser plugin extension to minimize the risk of exploitation until a patch is available. Avoid opening suspicious PDF documents from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Type Conversion or Cast

Enumeração de Fraquezas

CWE-704

Identificadores relacionados

CVE-2018-3843

Produtos afetados

Foxit Pdf Reader

Referências · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0526 · Exploit
• http://securityfocus.com/bid/103942 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3843 · Nota de Segurança
• http://securitytracker.com/id/1040733 · Nota
• https://osv.dev/vulnerability/CVE-2018-3843 · Aviso do Fabricante