PT-2018-14932 · Foxit · Foxit Reader

Published 2018-11-17 · Updated 2018-12-18 · CVE-2018-19348

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Foxit Reader version 9.3.0.10826

Description The issue allows remote attackers to cause a denial of service or obtain sensitive information via a U3D sample. This is due to a problem where "Data from Faulting Address controls Branch Selection" in the U3DBrowser plugin.

Recommendations For Foxit Reader version 9.3.0.10826, consider disabling the U3D plugin to minimize the risk of exploitation until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2018-19348

Affected Products

Foxit Reader

References · 7

• https://osv.dev/vulnerability/CVE-2018-19348 · Vendor Advisory
• https://foxitsoftware.com/support/security-bulletins.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19348 · Security Note
• ❌ https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/08/2018/11/2018-11-08/index.html · Note, Deleted
• ❌ https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html · Note, Deleted
• https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10 · Note
• https://yan-1-20.github.io/2018/11/08/2018/11/2018-11-08 · Note