Use of Uninitialized Variable in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - #VU52957
Published: May 6, 2021
Vulnerability identifier: #VU52957
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-457
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the array access violation resulting from the discrepant information in
the form control when users press the Tab key to get focus on a field
and input new text in certain XFA forms. A remote attacker can trick the victim into opening a specially crafted PDF file and gain access to sensitive information or crash the application.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Windows
Remediation
Install updates from vendor's website.
Foxit PDF Editor (formerly Foxit PhantomPDF) - update to 10.1.4.37651
Foxit PDF Reader for Windows - update to 10.1.4.37651
Foxit PDF Reader for Windows - update to 10.1.4.37651