SB2016070101 - Multiple vulnerabilities in Foxit Reader and PhantomPDF
Published: July 1, 2016
Security Bulletin ID
SB2016070101
Severity
High
Patch available
YES
Number of vulnerabilities
10
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) BMP parsing out-of-bounds read information disclosure vulnerability (CVE-ID: N/A)
The vulnerability allows a remote attacker to disclose sensitive information on vulnerable installations of Foxit Reader.The vulnerability exists within the ConvertToPDF plugin. A remote unauthenticated attacker can obtain sensitive information by triking a victim to visit a malicious page or open a malicious file.
Successful exploitation of this vulnerability may result in sensitive information disclosure.
2) Out-of-bounds write (CVE-ID: N/A)
The vulnerability allows a remote attacker to execute arbitrary code on vulnerable installations of Foxit Reader.The vulnerability exists within the ConvertToPDF plugin. A remote unauthenticated attacker can cause arbitrary code execution by tricking a victim to visit a malicious page or open a malicious file.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Out-of-bounds read (CVE-ID: N/A)
The vulnerability allows a remote attacker to leak sensitive information on vulnerable installations of Foxit Reader.The vulnerability exists within JPEG parsing. A remote unauthenticated attacker can obtain sensitive information by sending a specially crafted JPEG image to vulnerable server.
Successful exploitation of this vulnerability may result in sensitive information disclosure.
4) Out-of-bounds write (CVE-ID: N/A)
The vulnerability allows a remote attacker to execute arbitrary code on vulnerable installations of Foxit Reader.The vulnerability exists within the ConvertToPDF plugin. A remote unauthenticated attacker can cause arbitrary code execution by tricking a victim to visit a malicious page or open a malicious file.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Path traversal (CVE-ID: N/A)
The vulnerability allows a remote attacker to execute arbitrary code on vulnerable installations of Foxit Reader.The vulnerability exists due to Foxit Reader does not properly check the path passed to exportData. A remote unauthenticated attacker can execute arbitrary code by tricking a victim to visit a malicious page or open a malicious file.
Successful exploitation of this vulnerability may result in arbitrary code execution on the target system.
6) Information disclosure (CVE-ID: N/A)
The vulnerability allows a remote attacker to disclose sensitive information on vulnerable installations of Foxit Reader.The vulnerability exists within the handling of SWF files inside PDF files. A remote unauthenticated attacker can obtain sensitive information by tricking a victim to visit a malicious page or open a malicious file.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Stack-based buffer overflow (CVE-ID: N/A)
The vulnerability allows a remote attacker to execute arbitrary code on vulnerable installations of Foxit Reader.The vulnerability exists within FlateDecode. A remote unauthenticated attacker can cause stacked-based buffer overflow by sending a specially crafted PDF file to vulnerable server.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
8) Improper input validation (CVE-ID: N/A)
The vulnerability allows a remote attacker to execute arbitrary code on vulnerable installations of Foxit Reader.The vulnerability exists within the handling of PDF Patterns. A remote unauthenticated attacker can cause arbitrary code execution under the context of the current process by tricking a user to visit a malicious page or open a malicious file.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
9) Use-after-free error (CVE-ID: N/A)
The vulnerability allows a remote attacker to execute arbitrary code on vulnerable installations of Foxit Reader.The vulnerability exists within FlateDecode. A remote unauthenticated attacker can cause arbitrary code execution by sending a specially crafted PDF with a specific FlateDecode stream, that can force a dangling pointer to be reused after it has been freed.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
10) Stack-based buffer overflow (CVE-ID: N/A)
The vulnerability allows a remote attacker to to execute arbitrary code on vulnerable installations of Foxit Reader.The vulnerability exists within the handling of the GoToR action. A remote unauthenticated attacker can cause stacked-based buffer overflow by sending a PDF document with a specially crafted GoToR action to vulnerable server.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.