PT-2009-3319 · Foxit · Foxit Jpeg2000/Jbig2 Decoder Add-On+1

Will Dormann · Published 2009-06-23 · Updated 2009-06-26 · CVE-2009-0691

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Foxit Reader versions 3.0 before Build 1817 Foxit JPEG2000/JBIG2 Decoder add-on versions before 2.0.2009.616

Description The issue is related to the improper handling of a fatal error during the decoding of a JPEG2000 header, which can lead to memory corruption and application crash, or possibly allow the execution of arbitrary code. This can be triggered by a crafted PDF file that causes an invalid memory access.

Recommendations For Foxit Reader version 3.0 before Build 1817, update the Foxit JPEG2000/JBIG2 Decoder add-on to version 2.0.2009.616 or later. For Foxit JPEG2000/JBIG2 Decoder add-on versions before 2.0.2009.616, update to version 2.0.2009.616 or later.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-0691

Affected Products

Foxit Jpeg2000/Jbig2 Decoder Add-On

Foxit Reader

References · 7

• http://kb.cert.org/vuls/id/251793 · Patch
• http://vupen.com/english/advisories/2009/1640 · Vendor Advisory
• http://secunia.com/advisories/35512 · Vendor Advisory
• http://foxitsoftware.com/pdf/reader/security.htm#0602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0691 · Security Note
• http://securityfocus.com/bid/35443 · Patch
• http://securitytracker.com/id?1022425 · Note