PT-2015-1147 · Foxit · Foxit Reader+2

Published 2015-05-01 · Updated 2017-01-03 · CVE-2015-3633

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Foxit Reader, Enterprise Reader, and PhantomPDF versions prior to 7.1.5

Description The issue is related to a memory error when handling digital signatures, allowing remote attackers to cause a denial of service, resulting in memory corruption and a crash. This can be achieved through specially crafted digital signatures.

Recommendations For versions prior to 7.1.5, update to version 7.1.5 or later to resolve the issue.

Fix

DoS

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-119

Related Identifiers

BDU:2015-10032

CVE-2015-3633

Affected Products

Enterprise Reader

Foxit Reader

Phantompdf

References · 6

• http://foxitsoftware.com/support/security_bulletins.php#FRD-26 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3633 · Security Note
• https://bdu.fstec.ru/vul/2015-10032 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3633 · Security Note
• http://securitytracker.com/id/1032228 · Note
• http://securityfocus.com/bid/74418 · Note