PT-2018-16237 · Foxit · Foxit Pdf Reader

Published 2018-04-19 · Updated 2023-02-03 · CVE-2018-3843

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader version 9.0.1.1049

Description A type confusion issue exists in the way Foxit PDF Reader parses files with associated file annotations. This can be triggered by a specially crafted PDF document, potentially leading to sensitive memory disclosure and possibly arbitrary code execution. An attacker must trick the user into opening the malicious file to exploit this issue. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Recommendations For Foxit PDF Reader version 9.0.1.1049, consider disabling the browser plugin extension to minimize the risk of exploitation until a patch is available. Avoid opening suspicious PDF documents from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2018-3843

Affected Products

Foxit Pdf Reader

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0526 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3843 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3843 · Vendor Advisory
• http://securityfocus.com/bid/103942 · Note
• http://securitytracker.com/id/1040733 · Note