PT-2018-6534 · Foxit · Foxit Reader+1

Publicado 2018-04-24 · Atualizado 2018-06-05 · CVE-2017-17557

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Foxit Reader versions prior to 9.1 Foxit PhantomPDF versions prior to 9.1

Description: A flaw exists in the parsing of the BITMAPINFOHEADER record in BMP files due to the lack of proper validation of the biSize member. This can result in a heap-based buffer overflow, allowing an attacker to execute code in the context of the current process.

Recommendations: For Foxit Reader versions prior to 9.1, update to version 9.1 or later. For Foxit PhantomPDF versions prior to 9.1, update to version 9.1 or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-17557

Produtos afetados

Foxit Phantompdf

Foxit Reader

Referências · 6

• http://securityfocus.com/bid/103999 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-17557 · Nota de Segurança
• https://blog.0patch.com/2018/05/0patching-foxit-reader-buffer-oops.html · Nota
• https://foxitsoftware.com/support/security-bulletins.php · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-17557 · Aviso do Fabricante
• http://securitytracker.com/id/1040733 · Nota