Multiple vulnerabilities in Foxit MobilePDF for iOS



Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID N/A
CWE-ID CWE-20
CWE-22
Exploitation vector Network
Public exploit N/A
Vulnerable software
 MobilePDF for iOS
Mobile applications / Apps for mobile phones

Vendor Foxit Software Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper input validation

EUVDB-ID: #VU9176

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to insufficient validation of user-supplied input. A remote attacker can upload a specially crafted file including hexadecimal Unicode character in the “filename” parameter via Wi-Fi and case the application to fail to parse such file name.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update to version 6.1.

Vulnerable software versions

MobilePDF for iOS: 2.1.1.0321 - 6.0.0.1010

CPE2.3 External links

https://www.foxitsoftware.com/support/security-bulletins.php


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Directory traversal

EUVDB-ID: #VU9177

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to directory traversal. A remote attacker can send a specially crafted HTTP request, abuse the URL + escape character during Wi-Fi transfer, bypass security restrictions and manipulate the local application files maliciously.

Mitigation

Update to version 6.1.

Vulnerable software versions

MobilePDF for iOS: 2.1.1.0321 - 6.0.0.1010

CPE2.3 External links

https://www.foxitsoftware.com/support/security-bulletins.php


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###