BMP parsing out-of-bounds read information disclosure vulnerability in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - #VU68
Published: July 1, 2016
Vulnerability identifier: #VU68
CSH Severity: High
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-592
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information on vulnerable installations of Foxit Reader.
The vulnerability exists within the ConvertToPDF plugin. A remote unauthenticated attacker can obtain sensitive information by triking a victim to visit a malicious page or open a malicious file.
Successful exploitation of this vulnerability may result in sensitive information disclosure.
The vulnerability exists within the ConvertToPDF plugin. A remote unauthenticated attacker can obtain sensitive information by triking a victim to visit a malicious page or open a malicious file.
Successful exploitation of this vulnerability may result in sensitive information disclosure.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Windows
Remediation
Update your applications to the latest versions, which can be found at:
https://www.foxitsoftware.com/support/security-bulletins.php
https://www.foxitsoftware.com/support/security-bulletins.php