PT-2022-23954 · Foxit · Foxit Pdf Editor

Dohyun Lee + 1 · Published 2022-07-29 · Updated 2023-04-06 · CVE-2022-37377

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor version 11.1.1.53537

Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within JavaScript optimizations due to an improper optimization, resulting in a type confusion condition. This can allow an attacker to execute code in the context of the current process. The vulnerability may also lead to potential out-of-bounds read, use-after-free, or uninitialized variable issues when handling certain JavaScripts, potentially allowing adversaries to disclose information.

Recommendations For Foxit PDF Editor version 11.1.1.53537, consider disabling JavaScript optimizations as a temporary workaround until a patch is available. Restrict access to potentially malicious pages or files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2022-37377

ZDI-22-1049

Affected Products

Foxit Pdf Editor

References · 5

• https://osv.dev/vulnerability/CVE-2022-37377 · Vendor Advisory
• https://foxit.com/support/security-bulletins.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1049 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-37377 · Security Note
• https://t.me/cibsecurity/61038 · Telegram Post