Infinite loop in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - #VU27065
Published: April 22, 2020
Vulnerability identifier: #VU27065
CSH Severity: Low
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when processing actions that contain circular reference in PDF files. A remote attacker can consume all available system resources and cause denial of service conditions.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Windows
Remediation
Install updates from vendor's website.
Foxit PDF Editor (formerly Foxit PhantomPDF) - update to 9.7.2.29539
Foxit PDF Reader for Windows - update to 9.7.2.29539
Foxit PDF Reader for Windows - update to 9.7.2.29539