Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of service (memory corruption and application crash) or potentially execute arbitrary code via the Bezier data in a crafted PDF file.

According to its version, the Foxit Reader application installed on the remote Windows host is prior to 8.0. It is, therefore affected by multiple vulnerabilities:

  - Use-after-free vulnerability in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote     attackers to cause a denial of service (application crash) and execute arbitrary code via a crafted PDF     file. (CVE-2016-6168)

  - Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote     attackers to cause a denial of service (memory corruption and application crash) or potentially execute     arbitrary code via the Bezier data in a crafted PDF file. (CVE-2016-6169)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.1.1. It is, therefore, affected by multiple vulnerabilities.

According to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.0. It is, therefore, affected by multiple vulnerabilities.

According to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 7.3.9. It is, therefore, affected by multiple vulnerabilities.

Versions of Foxit Reader prior or equal to 7.3.4 are affected by the following vulnerbilities :

 - An overflow condition exists that is triggered as user-supplied input is not properly validated when handling 'GoToR' actions.  With a specially crafted PDF file, a context-dependent attacker can cause a stack-based buffer overflow, potentially allowing the execution of arbitrary code.
 - An overflow condition exists in the 'ConvertToPDF' plugin that is triggered as user-supplied input is not properly validated when handling 'SamplesPerPixel' values in TIFF images.  With a specially crafted TIFF image, a context-dependent attacker can cause a heap-based buffer overflow, potentially allowing the execution of arbitrary code.
 - A use-after-free error that is triggered when handling image descriptions.  With a specially crafted PDF file, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as user-supplied input is not properly validated when handling bezier data.  With a specially crafted PDF file, a context-dependent attacker can cause a heap-based buffer overflow, potentially allowing the execution of arbitrary code.
 - An unspecified out-of-bounds access flaw exists that is triggered as certain input is not properly validated.  With a specially crafted PDF file, a context-dependent attacker can potentially execute arbitrary code.
 - A flaw exists related to an uninitialized pointer being dereferenced when handling stretched images.  With a specially crafted PDF file, a context-dependent attacker can potentially execute arbitrary code.
 - An out-of-bounds read flaw exists in the 'ConvertToPDF' plugin that is triggered when converting BMP images.  This may allow a context-dependent attacker to disclose arbitrary memory content.
 - An out-of-bounds write flaw exists in the 'ConvertToPDF' plugin that is triggered when converting BMP images.  This may allow a context-dependent attacker to potentially execute arbitrary code.
 - An out-of-bounds write flaw exists in the 'ConvertToPDF' plugin that is triggered when converting GIF images.  This may allow a context-dependent attacker to potentially execute arbitrary code.
 - An out-of-bounds read flaw exists that is triggered when handling color components in JPEG images.  This may allow a context-dependent attacker to disclose arbitrary memory content.
 - An out-of-bounds read flaw exists in the 'ConvertToPDF' plugin that is triggered when converting JPEG images with specially crafted EXIF data.  This may allow a context-dependent attacker to disclose arbitrary memory content.
 - A flaw exists that is triggered as paths to 'exportData' are not properly checked.  This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists that is triggered during the handling of SWF files embedded inside PDF files.  This may allow a context-dependent attacker to bypass safe mode.
 - A use-after-free error is triggered when handling 'FlateDecode'. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error is triggered when handling the layout direction of XFA files. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.

ID	Name	Product	Family	Severity
182773	Foxit Reader < 8.0 Multiple Vulnerabilities	Nessus	Windows	high
119263	Foxit PhantomPDF < 8.1.1 Multiple Vulnerabilities	Nessus	Windows	high
119260	Foxit PhantomPDF < 8.0 Multiple Vulnerabilities	Nessus	Windows	high
119259	Foxit PhantomPDF < 7.3.9 Multiple Vulnerabilities	Nessus	Windows	high
9469	Foxit Reader < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	CGI	critical

Detections

Analytics

CVE-2016-6169

high

Tenable Plugins

high

high

high

high

critical