CVE-2018-19346: High severity foxit reader vulnerability

Published Nov 17, 2018

Updated

The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x00000000000d11ea" issue.

Affected Software

2 affected components

Foxitsoftware Foxit Reader=9.3.0.10826

Foxitsoftware U3d=9.3.0.10809

Event History

Nov 17, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-19346?

CVE-2018-19346 has a medium severity rating due to its potential for denial of service and information leakage.

How do I fix CVE-2018-19346?

To fix CVE-2018-19346, it is recommended to update Foxit Reader to the latest version provided by the vendor.

What vulnerabilities are associated with CVE-2018-19346?

CVE-2018-19346 is associated with memory handling issues in the u3d plugin used in Foxit Reader.

Can CVE-2018-19346 be exploited remotely?

Yes, CVE-2018-19346 can be exploited remotely by attackers via specially crafted U3D files.

Which versions of Foxit Reader are affected by CVE-2018-19346?

Foxit Reader version 9.3.0.10826 is specifically affected by CVE-2018-19346.