Dwelling › Endpoint Safety

FoxIt Patches Code Execution Flaws in PDF Instruments

By Ryan Naraine on December 19, 2022

Tweet

Foxit Software program has rolled out a critical-severity patch to cowl a harmful distant code execution flaw in its flagship PDF Reader and PDF Editor merchandise.

The vulnerability, which was found and reported by researchers on the Renmin College of China, might be exploited through rigged PDF recordsdata of net pages, the corporate warned in an advisory.

Foxit, which affords a substitute for Adobe’s ubiquitous PDF procession instruments, stated the vulnerability is contained to the Home windows platform and impacts Foxit PDF Reader 12.0.2.12465 and earlier, and the Foxit PhantomPDF – 10.1.7.37777 and earlier.

Barebones particulars from the Foxit advisory, which doesn’t comprise a CVE identifier:

Addressed potential points the place the applying might be uncovered to Out-of-Bounds Write vulnerability and crash when opening sure PDFs that comprise JavaScripts with an excessive amount of textual content laid out in sure controls, which might be exploited by attackers to execute arbitrary code.

This happens because of the entry of information exterior the bounds as the applying fails to validate the size of the enter parameter when calling sure API capabilities from the GDI library.

In response to HackSys Inc., an organization that independently found the Foxit vulnerability, warned that it might be exploited if a goal is tricked into visiting a rigged net web page or opening a malicious file.

“The particular flaw exists throughout the dealing with of Doc objects. The difficulty outcomes from the shortage of validating the existence of an object previous to performing operations on the item. An attacker can leverage this vulnerability to execute code within the context of the present course of,” HackSys stated in an advisory.

Foxit has struggled up to now with code execution points in its PDF-processing merchandise and a knowledge breach that affected greater than 300,000 customers. 

Associated: Foxit Patches A number of Code Execution Vulnerabilities in PDF Reader

Associated: Over 328,000 Customers Hit by Foxit Knowledge Breach

Associated: Foxit Plugs A number of Safety Holes in PDF Reader, Editor

Get the Each day Briefing

• Most Current
• Most Learn

• FoxIt Patches Code Execution Flaws in PDF Instruments
• Malicious PyPI Module Poses as SentinelOne SDK
• Google Workspace Will get Consumer-Facet Encryption in Gmail
• Cisco Warns of Many Previous Vulnerabilities Being Exploited in Assaults
• Glupteba Botnet Nonetheless Energetic Regardless of Google’s Disruption Efforts
• US Places three Dozen Extra Chinese language Firms on Commerce Blacklist
• US Meals Firms Warned of BEC Assaults Stealing Meals Product Shipments
• NIST to Retire 27-12 months-Previous SHA-1 Cryptographic Algorithm
• GitHub Proclaims Free Secret Scanning, Necessary 2FA
• Microsoft Reclassifies Home windows Flaw After IBM Researcher Proves Distant Code Execution

In search of Malware in All of the Incorrect Locations?

First Step For The Web’s subsequent 25 years: Including Safety to the DNS

Tattle Story: What Your Laptop Says About You

Be in a Place to Act By way of Cyber Situational Consciousness

Report Exhibits Closely Regulated Industries Letting Social Networking Apps Run Rampant

2010, A Nice 12 months To Be a Scammer.

Do not Let DNS be Your Single Level of Failure

How you can Establish Malware in a Blink

Defining and Debating Cyber Warfare

The 5 A’s that Make Cybercrime so Enticing

How you can Defend Towards DDoS Assaults

Safety Budgets Not in Line with Threats

Anycast – Three Causes Why Your DNS Community Ought to Use It

The Evolution of the Prolonged Enterprise: Safety Methods for Ahead Considering Organizations

Utilizing DNS Throughout the Prolonged Enterprise: It’s Dangerous Enterprise

Orbit Brain

http://orbitbrain.com/

Orbit Brain is the senior science writer and technology expert. Our aim provides the best information about technology and web development designing SEO graphics designing video animation tutorials and how to use software easy ways
and much more. Like Best Service Latest Technology, Information Technology, Personal Tech Blogs, Technology Blog Topics, Technology Blogs For Students, Futurism Blog.