Remote code execution in Foxit 3D Plugin Beta



Published: 2021-05-06
Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID N/A
CWE-ID CWE-416
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		3D Plugin Beta
Web applications / Modules and components for CMS

Vendor Foxit Software Inc.

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Use-after-free

EUVDB-ID: #VU52941

Risk: High

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing files. A remote attacker can create a specially crafted file with embedded malicious U3D objects, trick the victim into opening it and execute arbitrary code on the system

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

3D Plugin Beta: 9.3.0.10809 - 10.1.3.37598

CPE2.3 External links

http://www.foxitsoftware.com/support/security-bulletins.html?Security+update+available+in+3D+Plugin+Beta+10.1.4.376232021-05-06+00%3A00%3A00

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###