CVE-2018-9962: Use After Free
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of Annotation's author attribute. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5435.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Foxit Readerto a version that resolves this vulnerability.Fixed in 9.0.1.1049Patch ZDI-CAN-5435
Event History
Frequently Asked Questions
What does an attacker need to do to exploit this issue?
The attacker must cause the target to visit a malicious page or open a malicious file. No privileges are required, and the attack can be delivered remotely.
What level of access could successful exploitation provide?
Successful exploitation can execute arbitrary code in the context of the current process. The reported impact includes high confidentiality, integrity, and availability effects.
Which component is implicated by the vulnerability?
The flaw is in parsing the Annotation author attribute. It is a use-after-free condition caused by failing to validate that an object exists before operating on it.