Foxit PhantomPDF < 8.3.11 Multiple Vulnerabilities

high Nessus Plugin ID 127059

Language:

Synopsis

A PDF toolkit installed on the remote Windows host is affected by multiple vulnerabilities.

Description

According to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.3.11. It is, therefore affected by multiple vulnerabilities:

- An uninitialized pointer flaw exists when calling xfa.event.rest XFA JavaScript that can cause the application to crash the application.

- A NULL pointer dereference flaw exists when calling certain XFA JavaScript and can cause the application to crash. (CVE-2019-14212)
- An array-indexing error exists during XFA layout when the original node object contains one more contentArea object than that in XFA layout and cause the application to crash.

- A use-after-free remote code execution vulnerability exists when processing AcroForms because an additional event is triggered to delete ListBox and ComboBox Field when trying to delete the items in ListBox and ComboBox Field by calling the deleteItemAt method.
(CVE-2019-6774)

- A heap buffer overflow vulnerability exists because the maximum length in For loop is not updated correctly when all the Field APs are updated after executing Field related JavaScript, and this can cause the application to crash.

- An unspecified vulnerability exists where the repeated release of signature dictionary during CSG_SignatureF and CPDF_Document destruction can cause the application to crash.(CVE-2019-14213)

- An unspecified vulnerability exists due to the lack of proper validation of the existence of an object prior to performing operations on the object when executing JavaScript. This can cause the application to crash.
(CVE-2019-14211)

- A use-after-free remote code execution vulnerability exists because Field object is deleted during parameter calculation when setting certain attributes in Field object using JavaScript. (CVE-2019-6775, CVE-2019-6776, CVE-2019-13315, CVE-2019-13316, CVE-2019-13317, CVE-2019-13320)
- An infinite loop condition exists when calling the clone function due to confused relationships between the child and parent object caused by append error.
This can cause the application to crash. (CVE-2019-14207)

- A NULL pointer dereference flaw exists when parsing certain Epub files. This occurs because a null string is written to FXSYS_wcslen which does not support null strings. This can cause the application to crash.

- A use-after-free remote code execution vulnerability exists due to the use of Field objects or control after they have been deleted or released which can cause the application to crash. (CVE-2019-13319)
- An information disclosure vulnerability exists when calling util.printf JavaScript as the actual memory address of any variable available to the JavaScript can be extracted. (CVE-2019-13318)

- An out-of-bounds write vulnerability exists when users use the application in Internet Explorer because the input argument exceed the array length. This can cause the application to crash.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Foxit PhantomPDF version 8.3.11 or later.

Plugin Details

Severity: High

ID: 127059

File Name: foxit_phantom_8_3_11.nasl

Version: 1.6

Type: local

Agent: windows

Family: Windows

Published: 7/26/2019

Updated: 11/8/2019

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-6776

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:foxitsoftware:phantom, cpe:/a:foxitsoftware:phantompdf

Required KB Items: installed_sw/FoxitPhantomPDF

Exploit Ease: No known exploits are available

Patch Publication Date: 7/19/2019

Vulnerability Publication Date: 7/19/2019

Reference Information

CVE: CVE-2019-13315, CVE-2019-13316, CVE-2019-13317, CVE-2019-13318, CVE-2019-13319, CVE-2019-13320, CVE-2019-14207, CVE-2019-14211, CVE-2019-14212, CVE-2019-14213, CVE-2019-6774, CVE-2019-6775, CVE-2019-6776

BID: 109313, 109314, 109358, 109368

Detections

Analytics