Kpc

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier Description: The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, where a victim must open a malicious file. Recommendations: For versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier, update to a version that fixes the out-of-bounds read vulnerability to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier Description: The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, where a victim must open a malicious file. Recommendations: For versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier, update to a version that fixes this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier Adobe Acrobat 2020, Adobe Acrobat Reader 2020, Adobe Acrobat 2024 (affected versions not specified) **Description** The issue is related to an access of uninitialized pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file. The vulnerability is associated with the use of an uninitialized pointer when processing the `itemVariationDataCount` field. **Recommendations** For Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier: update to a version that fixes the access of uninitialized pointer vulnerability. For Adobe Acrobat 2020, Adobe Acrobat Reader 2020, Adobe Acrobat 2024: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 2024.3.0.26795 **Description** A use-after-free vulnerability exists in the way Foxit Reader handles a 3D page object. This can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory corruption and potentially resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site when the browser plugin extension is enabled. **Recommendations** For Foxit Reader version 2024.3.0.26795, consider disabling the handling of 3D page objects or the execution of Javascript code within PDF documents as a temporary workaround until a patch is available. Restrict access to malicious PDF files and avoid visiting untrusted websites with the browser plugin extension enabled to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 2024.3.0.26795 **Description** A use-after-free vulnerability exists in the way Foxit Reader handles a checkbox `CBF Widget` object. This vulnerability can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory corruption and potentially resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site with the browser plugin extension enabled. **Recommendations** For Foxit Reader version 2024.3.0.26795, consider disabling the browser plugin extension to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid opening suspicious PDF documents or visiting untrusted websites with the Foxit Reader browser plugin enabled. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader versions 20.005.30710 through 24.005.20307 **Description** The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file. **Recommendations** For Acrobat Reader versions 20.005.30710 through 24.005.20307, update to a version that is not affected by this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader versions 20.005.30710 through 24.005.20307 **Description** The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file. **Recommendations** For Acrobat Reader versions 20.005.30710 through 24.005.20307, update to a version that is not affected by this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier **Description** The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file. **Recommendations** For Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier, update to a version that is not affected by this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Veertu Anka Build version 1.42.0 **Description** A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build. The vulnerability occurs during Anka node agent update, allowing a low privilege user to trigger the issue. A specially crafted PKG file can lead to the execution of privileged operations. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. The issue is due to a Time-of-Check-to-Time-of-Use (TOCTOU) attack, where the downloaded package can be replaced with a malicious one before installation. **Recommendations** For Veertu Anka Build version 1.42.0, consider disabling the node update functionality until a patch is available to prevent exploitation. Restrict access to the Anka node agent update process to minimize the risk of privilege escalation. Avoid using specially crafted PKG files in the update process. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Veertu Anka Build version 1.42.0 **Description** A directory traversal vulnerability exists in the archive functionality of Veertu Anka. This vulnerability can be triggered by a specially crafted HTTP request, potentially leading to the disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to exploit this issue. **Recommendations** For Veertu Anka Build version 1.42.0, consider disabling the archive download functionality until a patch is available to prevent potential exploitation. Restrict access to sensitive information and limit unauthenticated HTTP requests to minimize the risk of disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Veertu Anka Build version 1.42.0 **Description** A directory traversal vulnerability exists in the log files download functionality. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. **Recommendations** For Veertu Anka Build version 1.42.0, consider disabling the log files download functionality until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. Avoid using the log files download feature in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat Reader versions 20.005.30636 through 24.002.20965 and earlier Adobe Acrobat versions prior to the fixed version (exact version not specified) **Description** The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file, specifically a PDF document containing JavaScript code. This allows a remote attacker to execute arbitrary code. **Recommendations** For Adobe Acrobat Reader versions 20.005.30636 and earlier, update to a version that is not affected by this issue. For Adobe Acrobat versions prior to the fixed version, apply the necessary patch or update to resolve the vulnerability. As a temporary workaround, consider avoiding the use of JavaScript code in PDF documents until a patch is available. Restrict access to untrusted PDF files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier **Description** The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file. This vulnerability allows attackers to memory leak. **Recommendations** For Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier, update to a version that is not affected by this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier Description: The issue is related to an out-of-bounds read vulnerability in the CoolType font processing framework of Acrobat Reader. This vulnerability can be exploited by an attacker using a specially crafted PDF file with an embedded malicious font file, potentially allowing the disclosure of sensitive memory information. The exploitation of this issue requires user interaction, such as opening a malicious file, and could enable an attacker to bypass certain security mitigations. Recommendations: For versions 20.005.30636, 24.002.20965, 24.002.20964, and 24.001.30123, update to a version that is not affected by this issue. For all versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider avoiding the use of potentially malicious PDF files until a patch is available. Restrict access to untrusted PDF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader versions 20.005.30636 through 24.003.20054 and earlier Adobe Acrobat 2020 and earlier Adobe Acrobat 2024 and earlier Adobe Acrobat Reader 2020 and earlier Adobe Acrobat Reader Document Cloud and earlier Adobe Acrobat Document Cloud and earlier **Description** The issue is related to a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises when the timing of actions changes the state of a resource between the checking of a condition and the use of the resource, allowing an attacker to manipulate the resource in a harmful way. Exploitation of this issue requires user interaction in that a victim must open a malicious file. The vulnerability is also associated with errors in synchronization when using a shared resource, which can be described as a "race condition". **Recommendations** For Acrobat Reader versions 20.005.30636 through 24.003.20054 and earlier, update to a version that is not affected by this issue. For Adobe Acrobat 2020 and earlier, update to a version that is not affected by this issue. For Adobe Acrobat 2024 and earlier, update to a version that is not affected by this issue. For Adobe Acrobat Reader 2020 and earlier, update to a version that is not affected by this issue. For Adobe Acrobat Reader Document Cloud and earlier, update to a version that is not affected by this issue. For Adobe Acrobat Document Cloud and earlier, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of shared resources that may be vulnerable to the "race condition" until a patch is available. Avoid opening malicious files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 2024.2.0.25138 **Description** A privilege escalation issue exists due to improper certification validation of the updater executable before executing it. This allows a low privilege user to trigger the update action, potentially resulting in unexpected elevation of privilege. **Recommendations** For Foxit Reader version 2024.2.0.25138, consider disabling the updater executable until a patch is available to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier **Description** The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, where a victim must open a malicious file. This allows an attacker to potentially leak memory. **Recommendations** For versions 20.005.30574 and earlier, and 24.002.20736 and earlier, consider avoiding the use of vulnerable functions related to file opening until a patch is available. As a temporary workaround, restrict the opening of files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier **Description** The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file. **Recommendations** For Acrobat Reader versions 20.005.30574 and earlier, consider upgrading to a newer version to mitigate the risk. For Acrobat Reader version 24.002.20736 and earlier, consider upgrading to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the opening of malicious files until a patch is available.

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 2024.1.0.23997 Description: A use-after-free vulnerability exists in the way Foxit Reader handles a Barcode widget. A specially crafted JavaScript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Recommendations: For Foxit Reader version 2024.1.0.23997, update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the browser plugin extension to minimize the risk of exploitation. Avoid opening malicious PDF documents from untrusted sources. Restrict access to untrusted websites to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 2024.1.0.23997 Description: A type confusion vulnerability exists in the way Foxit Reader handles a Lock object. This can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory corruption and potentially resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Recommendations: For Foxit Reader version 2024.1.0.23997, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, avoid opening malicious PDF documents and restrict access to untrusted websites, especially if the browser plugin extension is enabled.