Main Vulnerability Database Vulnerabilities #VU12066

Improper input validation in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - #VU12066

Published: April 20, 2018

Vulnerability identifier: #VU12066

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper input validation. A remote attacker can embed executable files to PDF portfolio from within the application, bypass security restrictions and execute arbitrary application.

Affected software

Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows

Remediation

Update to version 9.1.

External References

https://www.foxitsoftware.com/support/security-bulletins.php

Related Security Bulletins