Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-20248

In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table pointers or invalid xref table data using the LoadFromFile, LoadFromString, LoadFromStream, DAOpenFile or DAOpenFileReadOnly functions may result in an access violation caused by out of bounds memory access.

Published

2018-12-24T18:29:00.350

Last Modified

2024-11-21T04:01:09.903

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-787
Type: Primary
CWE-119

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	foxitsoftware	quick_pdf_library	< 16.12	Yes

References

http://www.securityfocus.com/bid/106306 Third Party Advisory, VDB Entry ([email protected])
https://www.foxitsoftware.com/support/security-bulletins.php Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/106306 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://www.foxitsoftware.com/support/security-bulletins.php Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)