CVE-2018-9984
published 2018-05-17CVE-2018-9984: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is…
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
2.50%
83.1th percentile
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of Texture Image Channels objects in U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5495.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| eglibc | eglibc | >= 0 < 2.19-0ubuntu6.15+esm3 | 2.19-0ubuntu6.15+esm3 |
| foxit | foxit_reader | — | — |
| foxitsoftware | foxit_reader | <= 9.0.1.1049 | — |
| foxitsoftware | phantompdf | <= 9.0.1.1049 | — |
| gnu | glibc | >= 0 < 2.23-0ubuntu11.3+esm6 | 2.23-0ubuntu11.3+esm6 |
| gnu | glibc | >= 0 < 2.27-3ubuntu1.6+esm2 | 2.27-3ubuntu1.6+esm2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
eglibc, glibc vulnerabilities
osv·2024-05-02·CVSS 9.8
CVE-2014-9984 eglibc, glibc vulnerabilities
eglibc, glibc vulnerabilities
It was discovered that GNU C Library incorrectly handled netgroup requests.
An attacker could possibly use this issue to cause a crash or execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9984)
It was discovered that GNU C Library might allow context-dependent
attackers to cause a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2015-20109)
It was discovered that GNU C Library when processing very long pathname arguments to
the realpath function, could encounter an integer overflow on 32-bit
architectures, leading to a stack-based buffer overflow and, potentially,
arbitrary code execution. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-11236)
It was discovered that the GNU C library getcwd function incorre
GHSA
GHSA-8hv8-w7m8-r9gr: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9
ghsa_unreviewed·2022-05-13
CVE-2018-9984 [MEDIUM] CWE-125 GHSA-8hv8-w7m8-r9gr: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of Texture Image Channels objects in U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5495.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-05-17
Published