CVE-2018-1180 — Use After Free in Foxit Reader

CWE-416 — Use After Free12 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.4%
top 41.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Foxitsoftware Foxit ReaderFoxitsoftware PhantompdfFoxit Reader
Timeline
PublishedMay 17
Latest updateMay 13

Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the AFSimple_Calculate method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code …

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5foxit/foxit_reader9.0.0.29935
▶NVDfoxitsoftware/phantompdf9.0.1.1049

Patches

Patch: www.foxitsoftware.com ↗Patch: www.foxitsoftware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-c59w-hpfr-55m3: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9↗2022-05-13
▶
CVEList
CVE-2018-1180: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9↗2018-05-17
▶

💬Community

9
Bugzilla
CVE-2018-11803 subversion: malicious SVN clients can crash mod_dav_svn↗2019-01-23
▶
Bugzilla
CVE-2018-16750 ImageMagick: Memory leak in the formatIPTCfromBuffer function in coders/meta.c↗2018-09-11
▶
Bugzilla
CVE-2018-16328 ImageMagick: NULL pointer dereference in CheckEventLogging function in MagickCore/log.c↗2018-09-03
▶
Bugzilla
CVE-2018-14436 ImageMagick: memory leak in ReadMIFFImage in coders/miff.c↗2018-07-30
▶
Bugzilla
CVE-2018-14434 ImageMagick: memory leak for a colormap in WriteMPCImage in coders/mpc.c↗2018-07-30
▶
CVE-2018-1180 — Use After Free in Foxit Reader | cvebase