cnvd - cnvd-2018-09986

CNVD-2018-09986

Vulnerability from cnvd - Published: 2018-05-22

Title

Foxit Reader XFA absPageSpan远程代码执行漏洞

Description

Foxit Reader是一款小型的PDF文档查看器和打印程序。 Foxit Reader在XFA absPageSpan方法中存在安全漏洞，由于缺乏对用户提供的数据的适当验证，导致攻击者可利用漏洞在当前进程上下文中执行任意代码。

Severity

中

Patch Name

Foxit Reader XFA absPageSpan远程代码执行漏洞的补丁

Patch Description

Foxit Reader是一款小型的PDF文档查看器和打印程序。 Foxit Reader在XFA absPageSpan方法中存在安全漏洞，由于缺乏对用户提供的数据的适当验证，导致攻击者可利用漏洞在当前进程上下文中执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://www.foxitsoftware.com/support/security-bulletins.php

Reference

https://nvd.nist.gov/vuln/detail/CVE-2018-9938 https://www.zerodayinitiative.com/advisories/ZDI-18-322/

Impacted products

Name
Foxit Reader 9.0.0.29935

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-9938",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9938"
    }
  },
  "description": "Foxit Reader\u662f\u4e00\u6b3e\u5c0f\u578b\u7684PDF\u6587\u6863\u67e5\u770b\u5668\u548c\u6253\u5370\u7a0b\u5e8f\u3002\r\n\r\nFoxit Reader\u5728XFA absPageSpan\u65b9\u6cd5\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7f3a\u4e4f\u5bf9\u7528\u6237\u63d0\u4f9b\u7684\u6570\u636e\u7684\u9002\u5f53\u9a8c\u8bc1\uff0c\u5bfc\u81f4\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u5f53\u524d\u8fdb\u7a0b\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "Anonymous",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\nhttps://www.foxitsoftware.com/support/security-bulletins.php",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-09986",
  "openTime": "2018-05-22",
  "patchDescription": "Foxit Reader\u662f\u4e00\u6b3e\u5c0f\u578b\u7684PDF\u6587\u6863\u67e5\u770b\u5668\u548c\u6253\u5370\u7a0b\u5e8f\u3002\r\n\r\nFoxit Reader\u5728XFA absPageSpan\u65b9\u6cd5\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7f3a\u4e4f\u5bf9\u7528\u6237\u63d0\u4f9b\u7684\u6570\u636e\u7684\u9002\u5f53\u9a8c\u8bc1\uff0c\u5bfc\u81f4\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u5f53\u524d\u8fdb\u7a0b\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Foxit Reader XFA absPageSpan\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Foxit Reader 9.0.0.29935"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-9938\r\nhttps://www.zerodayinitiative.com/advisories/ZDI-18-322/",
  "serverity": "\u4e2d",
  "submitTime": "2018-04-28",
  "title": "Foxit Reader XFA absPageSpan\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2018-9938 (GCVE-0-2018-9938)

Vulnerability from cvelistv5 – Published: 2018-05-17 15:00 – Updated: 2024-08-05 07:24

Summary

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the absPageSpan method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5372.

Severity ?

No CVSS data available.

CWE

CWE-704 - Incorrect Type Conversion or Cast

Assigner

zdi

References

URL

Tags

	https://zerodayinitiative.com/advisories/ZDI-18-322	x_refsource_MISC
	https://www.foxitsoftware.com/support/security-bu…	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Foxit	Foxit Reader	Affected: 9.0.0.29935

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:24:56.360Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://zerodayinitiative.com/advisories/ZDI-18-322"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.foxitsoftware.com/support/security-bulletins.php"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Foxit Reader",
          "vendor": "Foxit",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.0.29935"
            }
          ]
        }
      ],
      "datePublic": "2018-04-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the absPageSpan method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5372."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-704",
              "description": "CWE-704-Incorrect Type Conversion or Cast",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-17T14:57:01",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://zerodayinitiative.com/advisories/ZDI-18-322"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.foxitsoftware.com/support/security-bulletins.php"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "zdi-disclosures@trendmicro.com",
          "ID": "CVE-2018-9938",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Foxit Reader",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.0.0.29935"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Foxit"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the absPageSpan method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5372."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-704-Incorrect Type Conversion or Cast"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://zerodayinitiative.com/advisories/ZDI-18-322",
              "refsource": "MISC",
              "url": "https://zerodayinitiative.com/advisories/ZDI-18-322"
            },
            {
              "name": "https://www.foxitsoftware.com/support/security-bulletins.php",
              "refsource": "CONFIRM",
              "url": "https://www.foxitsoftware.com/support/security-bulletins.php"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2018-9938",
    "datePublished": "2018-05-17T15:00:00",
    "dateReserved": "2018-04-10T00:00:00",
    "dateUpdated": "2024-08-05T07:24:56.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-09986

CVE-2018-9938 (GCVE-0-2018-9938)

Tags

Sightings

Nomenclature