NULL pointer dereference in Foxit PDF Reader for Mac and Foxit PDF Editor for Mac (formerly PhantomPDF) - #VU68900
Published: November 1, 2022
Vulnerability identifier: #VU68900
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error when parsing certain PDF files whose colSpan attribute is set beyond the maximum length allowed. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
Affected software
Foxit PDF Reader for Mac
Foxit PDF Editor for Mac (formerly PhantomPDF)
Foxit PDF Editor for Mac (formerly PhantomPDF)
Remediation
Install updates from vendor's website.
Foxit PDF Reader for Mac - update to 12.0.2.1028
Foxit PDF Editor for Mac (formerly PhantomPDF) - update to 12.0.2.1028
Foxit PDF Editor for Mac (formerly PhantomPDF) - update to 12.0.2.1028