ID CVE-2018-3850
Summary An exploitable use-after-free vulnerability exists in the JavaScript engine Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If a browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
References
Vulnerable Configurations
  • cpe:2.3:a:foxit:pdf_reader:9.0.1.1049:*:*:*:*:*:*:*
    cpe:2.3:a:foxit:pdf_reader:9.0.1.1049:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 31-01-2023 - 20:15)
Impact:
Exploitability:
CWE CWE-416
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
refmap via4
bid 103942
misc https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0532
sectrack 1040733
Last major update 31-01-2023 - 20:15
Published 23-04-2018 - 15:29
Last modified 31-01-2023 - 20:15
Back to Top