PT-2021-22212 · Foxit · Foxit Pdf Editor+1

Published 2021-08-11 · Updated 2022-02-08 · CVE-2021-38563

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader versions prior to 11.0.1 Foxit PDF Editor versions prior to 11.0.1

Description The issue arises from incorrect handling of array sizes derived from a /Size entry, leading to situations where the array size is smaller than the maximum indirect object number. This results in attempted incorrect array access, which can cause a NULL pointer dereference, or out-of-bounds read or write.

Recommendations For Foxit PDF Reader versions prior to 11.0.1, update to version 11.0.1 or later. For Foxit PDF Editor versions prior to 11.0.1, update to version 11.0.1 or later.

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2021-38563

Affected Products

Foxit Pdf Editor

Foxit Pdf Reader

References · 3

• https://osv.dev/vulnerability/CVE-2021-38563 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38563 · Security Note
• https://foxitsoftware.com/support/security-bulletins.php · Vendor Advisory