CVE-2014-8074
Foxit ActiveX Pro SDK SetLogFile Buffer Overflow Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Buffer overflow in the SetLogFile method in Foxit.FoxitPDFSDKProCtrl.5 in Foxit PDF SDK ActiveX 2.3 through 5.0.1820 before 5.0.2.924 allows remote attackers to execute arbitrary code via a long string, related to global variables.
Desbordamiento de buffer en el método SetLogFile en Foxit.FoxitPDFSDKProCtrl.5 de Foxit PDF SDK ActiveX 2.3 hasta 5.0.1820 anteriores a 5.0.2.924 permite a atacantes remotos ejecutar código arbitrario a través de una larga cadena, relacionado con variables globales.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Foxit ActiveX Pro SDK ActiveX control. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the Foxit.FoxitPDFSDKProCtrl.5 ActiveX control. By passing an overly long string to the SetLogFile method, an attacker is able to overflow global variables in the control. This could be used to execute arbitrary code in the context of the browser.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-10-09 CVE Reserved
- 2014-10-14 CVE Published
- 2024-08-06 CVE Updated
- 2024-10-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/70608 | Vdb Entry | |
| http://www.zerodayinitiative.com/advisories/ZDI-14-362 | X_refsource_misc |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.foxitsoftware.com/support/security_bulletins.php#FRD-22 | 2016-04-04 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Foxitsoftware Search vendor "Foxitsoftware" | Foxit Pdf Sdk Activex Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" | 2.3 Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" and version "2.3" | - |
Affected
| ||||||
| Foxitsoftware Search vendor "Foxitsoftware" | Foxit Pdf Sdk Activex Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" | 3.0 Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" and version "3.0" | - |
Affected
| ||||||
| Foxitsoftware Search vendor "Foxitsoftware" | Foxit Pdf Sdk Activex Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" | 4.0 Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" and version "4.0" | - |
Affected
| ||||||
| Foxitsoftware Search vendor "Foxitsoftware" | Foxit Pdf Sdk Activex Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" | 5.0.0 Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" and version "5.0.0" | - |
Affected
| ||||||
| Foxitsoftware Search vendor "Foxitsoftware" | Foxit Pdf Sdk Activex Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" | 5.0.1.820 Search vendor "Foxitsoftware" for product "Foxit Pdf Sdk Activex" and version "5.0.1.820" | - |
Affected
| ||||||