CVE-2018-9963: Medium severity Foxitsoftware Foxit Reader vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5549.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-9963?
CVE-2018-9963 is classified as a medium severity vulnerability due to its requirement for user interaction to exploit.
How do I fix CVE-2018-9963?
To fix CVE-2018-9963, users should update Foxit Reader or PhantomPDF to the latest version available from the official website.
Who is affected by CVE-2018-9963?
CVE-2018-9963 affects versions of Foxit Reader and PhantomPDF up to and including 9.0.1.1049.
What type of information can be disclosed due to CVE-2018-9963?
CVE-2018-9963 can allow remote attackers to disclose sensitive information if the user interacts with a malicious webpage or file.
Is user interaction required to exploit CVE-2018-9963?
Yes, user interaction is required for exploiting CVE-2018-9963 as the user must open a malicious file or visit a harmful URL.