CVE-2018-19345: High severity foxit reader vulnerability

Published Nov 17, 2018

Updated

The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at U3DBrowser!PlugInMain+0x0000000000053f8b" issue.

Affected Software

2 affected components

Foxitsoftware Foxit Reader=9.3.0.10826

Foxitsoftware U3d=9.3.0.10809

Event History

Nov 17, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-19345?

CVE-2018-19345 is classified as a moderate severity vulnerability due to its potential for denial of service and information disclosure.

How can I mitigate CVE-2018-19345?

To mitigate CVE-2018-19345, users should update their Foxit Reader to version 9.3.0.10826 or later.

What type of attack does CVE-2018-19345 allow?

CVE-2018-19345 allows remote attackers to cause a denial of service through an out-of-bounds read in the U3D plugin.

Which software versions are affected by CVE-2018-19345?

CVE-2018-19345 affects Foxit Reader version 9.3.0.10826 and the U3D plugin version 9.3.0.10809.

What are the potential consequences of exploiting CVE-2018-19345?

Exploiting CVE-2018-19345 may result in application crashes or exposure of sensitive information through unauthorized access.