SB2021072703 - Multiple vulnerabilities in Foxit Reader and Foxit PhantomPDF
Published: July 27, 2021 Updated: August 30, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 24 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2021-21831)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling certain Javascripts or annotation objects in PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Use-after-free (CVE-ID: CVE-2021-21870)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling certain Javascripts or annotation objects in PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
3) Use-after-free (CVE-ID: CVE-2021-21893)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the "event.target" property. A remote attacker can execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
4) Use-after-free (CVE-ID: CVE-2021-34846)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when traversing bookmark nodes in certain PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
5) Use-after-free (CVE-ID: CVE-2021-34841)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
6) Use-after-free (CVE-ID: CVE-2021-34839)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
7) Use-after-free (CVE-ID: CVE-2021-34838)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
8) Use-after-free (CVE-ID: CVE-2021-34837)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
9) Use-after-free (CVE-ID: CVE-2021-34836)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
10) Use-after-free (CVE-ID: CVE-2021-34851)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
11) Use-after-free (CVE-ID: CVE-2021-34835)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
12) Use-after-free (CVE-ID: CVE-2021-34834)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
13) Use-after-free (CVE-ID: CVE-2021-34852)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
14) Use-after-free (CVE-ID: CVE-2021-34847)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling certain Javascripts or annotation objects in PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
15) Use-after-free (CVE-ID: CVE-2021-34832)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling certain Javascripts or annotation objects in PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
16) Use-after-free (CVE-ID: CVE-2021-34831)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling certain Javascripts or annotation objects in PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
17) Use-after-free (CVE-ID: CVE-2021-34853)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
18) Use-after-free (CVE-ID: CVE-2021-34840)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
19) Use-after-free (CVE-ID: CVE-2021-34845)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
20) Use-after-free (CVE-ID: CVE-2021-34844)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
21) Use-after-free (CVE-ID: CVE-2021-34843)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
22) Use-after-free (CVE-ID: CVE-2021-34842)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
23) Use-after-free (CVE-ID: CVE-2021-34833)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
24) Out-of-bounds write (CVE-ID: N/A)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can trick the victim to open a specially crafted PDF file, trigger an out-of-bounds write and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Remediation
Install update from vendor's website.
References
- https://www.foxitsoftware.com/support/security-bulletins.html?Security+updates+available+in+Foxit+PDF+Editor+Mac+11.0.1+and+Foxit+PDF+Reader+Mac+11.0.1+2021-07-27+00%3A00%3A00
- https://www.foxit.com/support/security-bulletins.html?Security+updates+available+in+Foxit+PDF+Reader...
- https://www.foxit.com/support/security-bulletins.html