PT-2016-7605 · Foxit · Foxit Reader+1

Published 2016-10-31 · Updated 2016-11-29 · CVE-2016-8877

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit Reader and PhantomPDF versions prior to 8.1

Description A heap buffer overflow issue, also referred to as an "out-of-bounds write" or "corrupted suffix pattern," exists in the handling of crafted JPEG2000 images embedded in PDF documents. This allows remote attackers to potentially execute arbitrary code.

Recommendations For Foxit Reader and PhantomPDF versions prior to 8.1, update to version 8.1 or later to resolve the issue.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2016-8877

Affected Products

Foxit Reader

Phantompdf

References · 4

• https://osv.dev/vulnerability/CVE-2016-8877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8877 · Security Note
• https://foxitsoftware.com/support/security-bulletins.php · Vendor Advisory
• http://securityfocus.com/bid/93608 · Note