CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-40129
https://notcve.org/view.php?id=CVE-2022-40129
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing Optional Content Group API, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled. Existe una vulnerabilidad de use-after-free en el motor JavaScript del Lector PDF de Foxit Software, versión 12.0.1.12430. • https://talosintelligence.com/vulnerability_reports/TALOS-2022-1614 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38097
https://notcve.org/view.php?id=CVE-2022-38097
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objects, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled. Existe una vulnerabilidad de use-after-free en el motor JavaScript del PDF Reader de Foxit Software, versión 12.0.1.12430. • https://talosintelligence.com/vulnerability_reports/TALOS-2022-1601 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-37332
https://notcve.org/view.php?id=CVE-2022-37332
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing media player API, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled. Existe una vulnerabilidad de use-after-free en el motor JavaScript del PDF Reader de Foxit Software, versión 12.0.1.12430. • https://github.com/SpiralBL0CK/CVE-2022-37332-RCE- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1602 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-32774
https://notcve.org/view.php?id=CVE-2022-32774
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely deleting objects associated with pages, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled. Existe una vulnerabilidad de use-after-free en el motor JavaScript del PDF Reader de Foxit Software, versión 12.0.1.12430. • https://talosintelligence.com/vulnerability_reports/TALOS-2022-1600 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-40326
https://notcve.org/view.php?id=CVE-2021-40326
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker can write to an arbitrary file, and display controlled contents, during signature verification. Foxit PDF Reader versiones anteriores a 11.1 y PDF Editor versiones anteriores a 11.1, y PhantomPDF versiones anteriores a 10.1.6, manejan inapropiadamente los datos ocultos e incrementales en los documentos firmados. Un atacante puede escribir en un archivo arbitrario, y mostrar contenidos controlados, durante la verificación de la firma • https://www.foxit.com/support/security-bulletins.html • CWE-347: Improper Verification of Cryptographic Signature •