CVE-2020-35931: High severity foxit reader vulnerability

Q: What is CVE-2020-35931?

CVE-2020-35931 is a vulnerability discovered in Foxit Reader and PhantomPDF that allows an attacker to spoof a certified PDF document through an Evil Annotation Attack.

Q: Which software versions are affected by CVE-2020-35931?

Foxit Reader versions before 10.1.1 and 4.1.1 on macOS, and PhantomPDF versions before 9.7.5 and 10.x before 10.1.1 on macOS are affected by CVE-2020-35931.

Q: How can an attacker exploit CVE-2020-35931?

An attacker can exploit CVE-2020-35931 by creating a malicious certified PDF document with an Evil Annotation Attack.

Q: What is the severity of CVE-2020-35931?

CVE-2020-35931 has a severity rating of 7.8 (High).

Q: Is my operating system affected by CVE-2020-35931?

Microsoft Windows and Apple macOS are not vulnerable to CVE-2020-35931.

Published Dec 31, 2020

Updated

An issue was discovered in Foxit Reader before 10.1.1 (and before 4.1.1 on macOS) and PhantomPDF before 9.7.5 and 10.x before 10.1.1 (and before 4.1.1 on macOS). An attacker can spoof a certified PDF document via an Evil Annotation Attack because the products fail to consider a null value for a Subtype entry of the Annotation dictionary, in an incremental update.

Affected Software

7 affected components

Foxitsoftware Foxit Reader<10.1.1

Foxitsoftware Phantompdf<9.7.5

Foxitsoftware Phantompdf>=10.0.0<10.1.1

Microsoft Windows

Foxitsoftware Foxit Reader<4.1.1

Foxitsoftware Phantompdf<4.1.1

macOS

Remediation

Patch Available

https://www.foxitsoftware.com/support/security-bulletins.html

Event History

Dec 31, 2020

CVE Published

via MITRE·08:14 PM

Data Sourced

via MITRE·08:14 PM

Description

Frequently Asked Questions

What is CVE-2020-35931?

CVE-2020-35931 is a vulnerability discovered in Foxit Reader and PhantomPDF that allows an attacker to spoof a certified PDF document through an Evil Annotation Attack.

Which software versions are affected by CVE-2020-35931?