PT-2018-6534 · Foxit · Foxit Reader+1

Published 2018-04-24 · Updated 2018-06-05 · CVE-2017-17557

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Foxit Reader versions prior to 9.1 Foxit PhantomPDF versions prior to 9.1

Description: A flaw exists in the parsing of the BITMAPINFOHEADER record in BMP files due to the lack of proper validation of the biSize member. This can result in a heap-based buffer overflow, allowing an attacker to execute code in the context of the current process.

Recommendations: For Foxit Reader versions prior to 9.1, update to version 9.1 or later. For Foxit PhantomPDF versions prior to 9.1, update to version 9.1 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-17557

Affected Products

Foxit Phantompdf

Foxit Reader

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-17557 · Security Note
• https://foxitsoftware.com/support/security-bulletins.php · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17557 · Vendor Advisory
• http://securityfocus.com/bid/103999 · Note
• https://blog.0patch.com/2018/05/0patching-foxit-reader-buffer-oops.html · Note
• http://securitytracker.com/id/1040733 · Note