CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-26537
https://notcve.org/view.php?id=CVE-2020-26537
An issue was discovered in Foxit Reader and PhantomPDF before 10.1. In a certain Shading calculation, the number of outputs is unequal to the number of color components in a color space. This causes an out-of-bounds write. Se detectó un problema en Foxit Reader y PhantomPDF versiones anteriores a 10.1. En un determinado cálculo de Shading, el número de salidas es desigual al número de componentes de color en un espacio de color. • https://www.foxitsoftware.com/support/security-bulletins.html • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-26538
https://notcve.org/view.php?id=CVE-2020-26538
An issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the current working directory. Se detectó un problema en Foxit Reader y PhantomPDF versiones anteriores a 10.1. Permite a atacantes ejecutar código arbitrario por medio de un troyano taskkill.exe en el directorio de trabajo actual • https://www.foxitsoftware.com/support/security-bulletins.html • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-26539
https://notcve.org/view.php?id=CVE-2020-26539
An issue was discovered in Foxit Reader and PhantomPDF before 10.1. When there is a multiple interpretation error for /V (in the Additional Action and Field dictionaries), a use-after-free can occur with resultant remote code execution (or an information leak). Se detectó un problema en Foxit Reader y PhantomPDF versiones anteriores a 10.1. Cuando se presenta un error de interpretación múltiple para /V (en los diccionarios de Additional Action y Field), puede ocurrir un uso de la memoria previamente liberada con una ejecución de código remoto resultante (o un filtrado de información) • https://www.foxitsoftware.com/support/security-bulletins.html • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-17415 – Foxit PhantomPDF Update Service Incorrect Permission Assignment Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-17415
This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PhantomPDF 10.0.0.35798. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the configuration files used by the Foxit PhantomPDF Update Service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. • https://www.foxitsoftware.com/support/security-bulletins.php https://www.zerodayinitiative.com/advisories/ZDI-20-1232 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-17416 – Foxit Reader JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-17416
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.foxitsoftware.com/support/security-bulletins.php https://www.zerodayinitiative.com/advisories/ZDI-20-1233 • CWE-787: Out-of-bounds Write •