#VU52938 Input validation error in Foxit PDF Reader for Windows and Foxit PDF Editor (formerly Foxit PhantomPDF)


Published: 2021-05-06

Vulnerability identifier: #VU52938

Vulnerability risk: High

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Foxit PDF Reader for Windows
Client/Desktop applications / Office applications
Foxit PDF Editor (formerly Foxit PhantomPDF)
Client/Desktop applications / Office applications

Vendor: Foxit Software Inc.

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to  use of incorrect parameters or objects without proper validation in the implementation of certain functions in JavaScript. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and execute arbitrary code on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Foxit PDF Reader for Windows: 9.0 - 10.1.3.37598

Foxit PDF Editor (formerly Foxit PhantomPDF): 10.0.0.35798 - 10.1.3.37598, 9.0.0.29935 - 9.7.5.29616


CPE

External links
http://www.foxitsoftware.com/support/security-bulletins.html?Security+updates+available+in+Foxit+Reader+10.1.4+and+Foxit+PhantomPDF+10.1.42021-05-06+00%3A00%3A00


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?


Latest bulletins with this vulnerability