Improper verification of cryptographic signature in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - #VU101823

Vulnerability identifier: #VU101823

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to the application improperly ignores the changes to the “/NeedsRendering” key or “TextField” field when verifying the XFA documents. A remote attacker perform spoofing attack and make users believe that the document is properly signed.

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Mac
Foxit PDF Editor for Mac (formerly PhantomPDF)

Install updates from vendor's website.

Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 11.2.12.54161, 12.1.9.15762, 13.1.5.23566, 2024.4.0.27683
Foxit PDF Reader for Windows - update to 2024.4.0.27683
Foxit PDF Reader for Mac - update to 2024.4.0
Foxit PDF Editor for Mac (formerly PhantomPDF) - addressed in versions 11.1.11.1202, 12.1.7.55606, 13.1.5.63001, 2024.4.0.66473

• https://www.foxitsoftware.com/support/security-bulletins.html?Security+updates+available+in+Foxit+PDF+Reader+2024.4+and+Foxit+PDF+Editor+2024.4%2F13.1.52024-12-17+00%3A00%3A00

• Multiple vulnerabilities in Foxit PDF Reader and Editor for Windows
• Multiple vulnerabilities in Foxit PDF Reader and Editor for Mac