CVE-2009-0690
published 2009-06-23CVE-2009-0690: The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a negative value for the stream…
PriorityP337critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
5.68%
92.2th percentile
The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a negative value for the stream offset in a JPEG2000 (aka JPX) stream, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted PDF file that triggers an out-of-bounds read.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| foxitsoftware | foxit_reader | — | — |
| foxitsoftware | foxit_reader | — | — |
| foxitsoftware | jpeg2000_jbig2_decoder_add-on | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Improper Restriction of Operations within the Bounds of a Memory Buffer
mitre_cwe
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Background: Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Confidentiality, Availability. Impact: Execute Unauthorized Code or Commands, Modify Memory. If the memory accessible by the attacker can be effec
CWE
Use of Out-of-range Pointer Offset
mitre_cwe
CWE-823 Use of Out-of-range Pointer Offset
CWE-823: Use of Out-of-range Pointer Offset
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
While a pointer can contain a reference to any arbitrary memory location, a program typically only intends to use the pointer to access limited portions of memory, such as contiguous memory used to access an individual array. Programs may use offsets in order to access fields or sub-elements stored within structured data. The offset might be out-of-range if it comes from an untrusted source, is the result of an incorrect calculation, or occurs because of another error. If an attacker can control or influence the offset so that it points outside of the intended boundar
http://secunia.com/advisories/35512http://securitytracker.com/id?1022425http://www.foxitsoftware.com/pdf/reader/security.htm#0602http://www.kb.cert.org/vuls/id/251793http://www.securityfocus.com/bid/35442http://www.vupen.com/english/advisories/2009/1640http://secunia.com/advisories/35512http://securitytracker.com/id?1022425http://www.foxitsoftware.com/pdf/reader/security.htm#0602http://www.kb.cert.org/vuls/id/251793http://www.securityfocus.com/bid/35442http://www.vupen.com/english/advisories/2009/1640
2009-06-23
Published