CVE-2017-10948 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of

CVE-2017-10948

Summary

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the app.execMenuItem function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-4723.

References

Vulnerable Configurations

cpe:2.3:a:foxitsoftware:foxit_reader:8.2.1.6871:*:*:*:*:*:*:*
cpe:2.3:a:foxitsoftware:foxit_reader:8.2.1.6871:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 09-10-2019 - 23:21)
Impact:
Exploitability:

CWE

CWE-416

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bid	101670
confirm	https://www.foxitsoftware.com/support/security-bulletins.php
misc	https://zerodayinitiative.com/advisories/ZDI-17-461

Last major update

09-10-2019 - 23:21

Published

31-10-2017 - 19:29

Last modified

09-10-2019 - 23:21