ZDI-19-432: Foxit Reader ConvertToPDF JPG File Parsing Use-After-Free Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDFx86.dll. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-19-432?
The vulnerability ZDI-19-432 is classified as a high severity risk due to the potential for sensitive information disclosure.
How do I fix ZDI-19-432?
To remediate ZDI-19-432, ensure that you update to the latest version of Foxit Reader as recommended by the vendor.
What type of attacker is associated with ZDI-19-432?
ZDI-19-432 can be exploited by remote attackers who require user interaction to open a malicious file or visit a malicious page.
What are the consequences of ZDI-19-432?
If exploited, ZDI-19-432 could lead to the unauthorized disclosure of sensitive information from affected installations of Foxit Reader.
Is user interaction required to exploit ZDI-19-432?
Yes, user interaction is required for ZDI-19-432, as the target must either visit a malicious webpage or open a malicious file.