Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow or an out-of-bounds read.

According to its version, the Foxit Reader application installed on the remote Windows host is prior to 9.5. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 9.5. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its version, the Foxit Reader application (formally known as Phantom) installed on the remote Windows host is prior to 8.3.10. It is, therefore, affected by multiple vulnerabilities:

  - A heap-based buffer overflow condition exists in the     proxyCPDFAction, proxyCheckLicence, proxyDoAction,     proxyGetAppEdition, or proxyPreviewAction due to a stack buffer     overflow or out-of-bounds read. An authenticated, local attacker     can exploit this, via large integer or long string causing a     denial of service condition or the execution of arbitrary code.

  - A directory traversal vulnerability exists in the cPDF plugin due     to unexpected javascript invocation resulting in remote code     execution. An unauthenticated, remote attacker can exploit this,     by invoking javascript through the console to write local files.     (ZDI-CAN-7407)

  - A integer overflow and crash condition exists in the XFA stuff     method due to the lack of proper validation of user-supplied     data. An attacker can explit this to disclose information.     (ZDI-CAN-7561)

  - A use-after-free, out-of-bounds read, and crash vulnerability     exists when converting HTML files to PDFs. An authenticated,     remote attacker can exploit this to disclose information     or to execute arbitrary code.     (ZDI-CAN-7620/ZDI-CAN-7844/ZDI-CAN-8170)   

  - A out-of-bounds write and crash vulnerability exists. An     authenticated, remote attacker can exploit this to execute     arbitrary code. (ZDI-CAN-7613/ZDI-CAN-7614/ZDI-CAN-7701/     ZDI-CAN-7972)

  - A use-after-free or out-of-bounds write and crash vulnerability     exists. An authenticated, local attacker can exploit this to     execute arbitrary code. (ZDI-CAN-7696/ZDI-CAN-7694)

  - A use-after-free vulnerability. An authenticated,     remote attacker can exploit this to execute arbitrary     code. (ZDI-CAN-7696/ZDI-CAN-7694/ZDI-CAN-7777/ZDI-CAN-7874)

  - A use-after-free, remote code execution, information     disclosure vulnerability exists when deleting Field with nested     scripts. An authenticated, local attacker can exploit this to     execute arbitrary code. (ZDI-CAN-8162/ZDI-CAN-8163/ZDI-CAN-8164/     ZDI-CAN-8165/ZDI-CAN-8229/ZDI-CAN-8230/ZDI-CAN-8231/ZDI-CAN-8272)

According to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.3.10. It is, therefore, affected by multiple vulnerabilities:

  - A heap-based buffer overflow condition exists in the     proxyCPDFAction, proxyCheckLicence, proxyDoAction,     proxyGetAppEdition, or proxyPreviewAction due to a stack buffer     overflow or out-of-bounds read. An authenticated, local attacker     can exploit this, via large integer or long string causing a     denial of service condition or the execution of arbitrary code.

  - A directory traversal vulnerability exists in the cPDF plugin due     to unexpected javascript invocation resulting in remote code     execution. An unauthenticated, remote attacker can exploit this,     by invoking javascript through the console to write local files.     (ZDI-CAN-7407)

  - A integer overflow and crash condition exists in the XFA stuff     method due to the lack of proper validation of user-supplied     data. An attacker can explit this to disclose information.     (ZDI-CAN-7561)

  - A use-after-free, out-of-bounds read, and crash vulnerability     exists when converting HTML files to PDFs. An authenticated,     remote attacker can exploit this to disclose information     or to execute arbitrary code.     (ZDI-CAN-7620/ZDI-CAN-7844/ZDI-CAN-8170)   

  - A out-of-bounds write and crash vulnerability exists. An     authenticated, remote attacker can exploit this to execute     arbitrary code. (ZDI-CAN-7613/ZDI-CAN-7614/ZDI-CAN-7701/     ZDI-CAN-7972)

  - A use-after-free or out-of-bounds write and crash vulnerability     exists. An authenticated, local attacker can exploit this to     execute arbitrary code. (ZDI-CAN-7696/ZDI-CAN-7694)

  - A use-after-free vulnerability. An authenticated,     remote attacker can exploit this to execute arbitrary     code. (ZDI-CAN-7696/ZDI-CAN-7694/ZDI-CAN-7777/ZDI-CAN-7874)

  - A use-after-free, remote code execution, information     disclosure vulnerability exists when deleting Field with nested     scripts. An authenticated, local attacker can exploit this to     execute arbitrary code. (ZDI-CAN-8162/ZDI-CAN-8163/ZDI-CAN-8164/     ZDI-CAN-8165/ZDI-CAN-8229/ZDI-CAN-8230/ZDI-CAN-8231/ZDI-CAN-8272)

ID	Name	Product	Family	Severity
131078	Foxit Reader < 9.5 Multiple Vulnerabilities	Nessus	Windows	high
131077	Foxit PhantomPDF < 9.5 Multiple Vulnerabilities	Nessus	Windows	high
125153	Foxit Reader < 9.5.0 Multiple Vulnerabilities	Nessus	Windows	high
124413	Foxit PhantomPDF < 9.5.0 Multiple Vulnerabilities	Nessus	Windows	high
124412	Foxit PhantomPDF < 8.3.10 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2018-20309

high

Tenable Plugins

high

high

high

high

high