PT-2020-5589 · Foxit · Foxit Reader+1

Hungtt28 · Published 2020-04-16 · Updated 2020-04-30 · CVE-2020-10906

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Foxit Reader version 9.7.1.29511 Foxit PhantomPDF (affected versions not specified)

Description The issue is related to a use-after-free vulnerability in the resetForm method, which can be exploited by remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists due to the lack of validation of an object's existence before performing operations on it, allowing an attacker to execute code in the context of the current process.

Recommendations For Foxit Reader version 9.7.1.29511, consider disabling the resetForm method as a temporary workaround until a patch is available. For Foxit PhantomPDF, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2021-01210

CVE-2020-10906

ZDI-20-534

Affected Products

Foxit Phantompdf

Foxit Reader

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-10906 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-534 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10906 · Vendor Advisory
• https://foxitsoftware.com/support/security-bulletins.php · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01210 · Security Note
• https://foxitsoftware.com/support/security-bulletins.html · Note
• https://t.me/cvenotify/3079 · Telegram Post
• https://cxsecurity.com/cveshow/CVE-2020-10906 · Note