CVE-2017-14828 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of

CVE-2017-14828

Summary

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the w method of XFA Layout objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5020.

References

Vulnerable Configurations

cpe:2.3:a:foxitsoftware:foxit_reader:8.3.1.21155:*:*:*:*:*:*:*
cpe:2.3:a:foxitsoftware:foxit_reader:8.3.1.21155:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 09-10-2019 - 23:24)
Impact:
Exploitability:

CWE

CWE-704

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

confirm	https://www.foxitsoftware.com/support/security-bulletins.php
misc	https://zerodayinitiative.com/advisories/ZDI-17-872

Last major update

09-10-2019 - 23:24

Published

20-12-2017 - 14:29

Last modified

09-10-2019 - 23:24