ZDI-CAN-23702: ZDI-24-1124: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2024-7722.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23702?
The severity of ZDI-CAN-23702 is moderate as it allows remote attackers to disclose sensitive information requiring user interaction.
How do I fix ZDI-CAN-23702?
To fix ZDI-CAN-23702, ensure that you update to the latest version of Foxit PDF Reader as advised in their security bulletins.
What are the consequences of ZDI-CAN-23702?
The consequences of ZDI-CAN-23702 include potential exposure of sensitive information if users interact with malicious content.
Is user interaction required to exploit ZDI-CAN-23702?
Yes, user interaction is required for ZDI-CAN-23702 since the user must visit a malicious page or open a malicious file.
Which versions of Foxit PDF Reader are affected by ZDI-CAN-23702?
ZDI-CAN-23702 affects certain installations of Foxit PDF Reader, but specific affected versions should be confirmed by checking the vendor's advisory.