Improper Verification of Cryptographic Signature in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - #VU27067
Published: April 22, 2020
Vulnerability identifier: #VU27067
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to incorrect validation of signatures of PDF files. A remote attacker can bypass signature validation process and bypass implemented security restrictions.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Windows
Remediation
Install updates from vendor's website.
Foxit PDF Editor (formerly Foxit PhantomPDF) - update to 9.7.2.29539
Foxit PDF Reader for Windows - update to 9.7.2.29539
Foxit PDF Reader for Windows - update to 9.7.2.29539