CVE-2018-19348: High severity foxit reader vulnerability

Published Nov 17, 2018

Updated

The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x000000000012dff5" issue.

Affected Software

2 affected components

Foxitsoftware Foxit Reader=9.3.0.10826

Foxitsoftware U3d=9.3.0.10809

Event History

Nov 17, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-19348?

CVE-2018-19348 has a medium severity, as it allows remote attackers to potentially cause denial of service or expose sensitive information.

How do I fix CVE-2018-19348?

To fix CVE-2018-19348, update Foxit Reader to version 9.3.0.10826 or later, which contains the necessary security patches.

What type of vulnerability is CVE-2018-19348?

CVE-2018-19348 is a denial of service vulnerability caused by out-of-bounds reads in the u3d plugin for Foxit Reader.

What are the affected versions for CVE-2018-19348?

CVE-2018-19348 affects Foxit Reader version 9.3.0.10826 and the u3d plugin version 9.3.0.10809.

Can CVE-2018-19348 be exploited remotely?

Yes, CVE-2018-19348 can be exploited remotely by attackers through specially crafted U3D sample files.