Foxit PhantomPDF up to 9.7.1 U3D Object PDF File heap-based overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in Foxit PhantomPDF. This vulnerability affects unknown code of the component U3D Object Handler. The manipulation as part of PDF File results in heap-based overflow. This vulnerability is reported as CVE-2020-10896. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Foxit PhantomPDF. It has been classified as critical. Affected is some unknown functionality of the component U3D Object Handler. The manipulation as part of a PDF File leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10192.

The weakness was disclosed 04/22/2020. This vulnerability is traded as CVE-2020-10896 since 03/24/2020. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 9.7.1.29511 eliminates this vulnerability.

The entries VDB-154214, VDB-154213, VDB-154211 and VDB-154210 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Foxit

Name

• PhantomPDF

Version

• 3.3
• 3.4
• 4.0
• 4.1
• 8.3.6
• 8.3.7
• 8.3.10
• 8.3.11
• 8.3.12
• 9.1
• 9.1.5096
• 9.2
• 9.2.0.9297
• 9.3
• 9.3.10826
• 9.4.0.16811
• 9.4.1.16828
• 9.5
• 9.5.0.20723
• 9.5.0.20733
• 9.6
• 9.6.0.25114
• 9.6.0.25608
• 9.7
• 9.7.0.2947
• 9.7.0.29430
• 9.7.0.29478
• 9.7.1

License

• free

Website

• Vendor: https://www.foxitsoftware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion