CVE-2019-6754
published 2019-06-03CVE-2019-6754: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to…
PriorityP344high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
4.52%
90.5th percentile
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the localFileStorage method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7407.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| foxit | reader | — | — |
| foxitsoftware | foxit_reader | <= 9.4.1.16828 | — |
| foxitsoftware | phantompdf | <= 8.3.9.41099 | — |
| foxitsoftware | phantompdf | 9.0.0 – 9.4.1.16828 | — |
| nghttp2 | nghttp2 | >= 0 < 1.59.0-1ubuntu0.1 | 1.59.0-1ubuntu0.1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.07.3HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nghttp2 vulnerability
osv·2024-05-07·CVSS 7.5
CVE-2019-9511 nghttp2 vulnerability
nghttp2 vulnerability
USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the
corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited
GHSA
GHSA-53m2-mrx2-vg6r: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9
ghsa_unreviewed·2022-05-24
CVE-2019-6754 [HIGH] CWE-22 GHSA-53m2-mrx2-vg6r: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the localFileStorage method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7407.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-06-03
Published