PT-2023-7346 · Foxit · Foxit Pdf Reader

Kamlapati Choubey · Published 2023-11-27 · Updated 2023-12-01 · CVE-2023-41257

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader versions 12.1.2.15356

Description The issue is related to a type confusion vulnerability in the way Foxit Reader handles field value properties. This can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory corruption and potentially allowing an attacker to execute arbitrary code. An attacker can exploit this by tricking a user into opening a malicious file or by having the user visit a specially crafted malicious site if the browser plugin extension is enabled.

Recommendations For Foxit PDF Reader version 12.1.2.15356, consider disabling the browser plugin extension to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid opening PDF files from untrusted sources to reduce the risk of triggering the vulnerability. Restrict access to malicious sites to prevent potential exploitation through the browser. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2023-08377

CVE-2023-41257

Affected Products

Foxit Pdf Reader

References · 5

• https://osv.dev/vulnerability/CVE-2023-41257 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08377 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-41257 · Security Note
• https://t.me/cvenotify/61941 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1838 · Note