#VU16806 Integer overflow in 3D Plugin Beta

Vulnerability identifier: #VU16806

Vulnerability risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-190

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
3D Plugin Beta
Web applications / Modules and components for CMS

Vendor: Foxit Software Inc.

Description
The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to the free of valid memory when handling certain PDF file that embeds specifically crafted 3D content. A remote attacker can trick the victim into processing a specially crafted PDF file, trigger integer overflow and cause the service to crash.

Mitigation
Update to version 9.4.0.16807.

Vulnerable software versions

3D Plugin Beta: 8.3.8.1122 - 9.3.0.10830

---

External links
https://www.foxitsoftware.com/support/security-bulletins.php

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.