ZDI-20-932: Foxit PhantomPDF SetLocalDescription Use-After-Free Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the SetLocalDescription method. By performing actions in JavaScript, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-20-932?
ZDI-20-932 is classified as a medium severity vulnerability due to its potential to disclose sensitive information.
How do I fix ZDI-20-932?
To fix ZDI-20-932, you should update to the latest version of Foxit PhantomPDF, as security patches will address this vulnerability.
What kind of attack is associated with ZDI-20-932?
ZDI-20-932 is associated with remote attacks that require user interaction, such as visiting a malicious webpage or opening a malicious file.
Who is affected by ZDI-20-932?
Any user of Foxit PhantomPDF for Windows is potentially affected by ZDI-20-932.
What type of information can be disclosed due to ZDI-20-932?
ZDI-20-932 may allow attackers to access sensitive information from the affected installations of Foxit PhantomPDF.