Foxit Reader 9.0.1.1049 ConvertToPDF_x86.dll out-of-bounds write

Summaryinfo

A vulnerability marked as critical has been reported in Foxit Reader 9.0.1.1049. This issue affects some unknown processing in the library ConvertToPDF_x86.dll. The manipulation leads to out-of-bounds write. This vulnerability is uniquely identified as CVE-2018-11622. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Foxit Reader 9.0.1.1049 (Document Reader Software). This issue affects an unknown code in the library ConvertToPDF_x86.dll. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-5873.

The bug was discovered 07/19/2018. The weakness was disclosed 07/31/2018 (Website). The advisory is shared at foxitsoftware.com. The identification of this vulnerability is CVE-2018-11622 since 05/31/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 12 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-82783, VDB-82784, VDB-82785 and VDB-82786 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Document Reader Software

Vendor

• Foxit

Name

• Reader

Version

• 9.0.1.1049

License

• free

Website

• Vendor: https://www.foxitsoftware.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion