CVE-2018-19343: High severity foxit reader vulnerability

Published Nov 17, 2018

Updated

The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a "Data from Faulting Address controls Code Flow starting at U3DBrowser!PlugInMain+0x00000000000f43ff" issue.

Affected Software

2 affected components

Foxitsoftware Foxit Reader=9.3.0.10826

Foxitsoftware U3d=9.3.0.10809

Event History

Nov 17, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-19343?

CVE-2018-19343 has a medium severity, allowing for denial of service or potential information disclosure.

How do I fix CVE-2018-19343?

To mitigate CVE-2018-19343, update Foxit Reader to version 9.3.0.10827 or later.

What impact does CVE-2018-19343 have on affected systems?

CVE-2018-19343 can lead to out-of-bounds reads and might disclose sensitive information.

Which versions of Foxit Reader are affected by CVE-2018-19343?

Foxit Reader versions prior to 9.3.0.10827, specifically 9.3.0.10826, are vulnerable to CVE-2018-19343.

Can CVE-2018-19343 be exploited remotely?

Yes, CVE-2018-19343 can be exploited remotely through specially crafted U3D samples.