Vulnerabilities > CVE-2017-6883 - Out-of-bounds Read vulnerability in Foxitsoftware Foxit Reader and Phantompdf

CVSS 2.6 - LOW

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

high complexity

foxitsoftware

microsoft

CWE-125

NVD

Published: 2017-03-14

Updated: 2019-10-03

Summary

The ConvertToPDF plugin in Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF image. The vulnerability could lead to information disclosure; an attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.

Vulnerable Configurations

Part	Description	Count
Application	Foxitsoftware Foxitsoftware Foxit Reader 2.0 Foxitsoftware Foxit Reader 2.2 Foxitsoftware Foxit Reader 2.3 Foxitsoftware Foxit Reader 3.0 Foxitsoftware Foxit Reader 3.1 Foxitsoftware Foxit Reader 3.1.0.0111 Foxitsoftware Foxit Reader 3.1.2.1013 Foxitsoftware Foxit Reader 3.1.2.1030 Foxitsoftware Foxit Reader 3.1.4 Foxitsoftware Foxit Reader 3.2 Foxitsoftware Foxit Reader 3.2.0.0303 Foxitsoftware Foxit Reader 3.2.1.0401 Foxitsoftware Foxit Reader 3.3 Foxitsoftware Foxit Reader 3.3.1 Foxitsoftware Foxit Reader 4.0 Foxitsoftware Foxit Reader 4.0.0.0619 Foxitsoftware Foxit Reader 4.1 Foxitsoftware Foxit Reader 4.1.1 Foxitsoftware Foxit Reader 4.1.1.0805 Foxitsoftware Foxit Reader 4.2 Foxitsoftware Foxit Reader 4.3 Foxitsoftware Foxit Reader 4.3.1.0218 Foxitsoftware Foxit Reader 5.0 Foxitsoftware Foxit Reader 5.0.2 Foxitsoftware Foxit Reader 5.0.2.0718 Foxitsoftware Foxit Reader 5.1 Foxitsoftware Foxit Reader 5.1.0.1021 Foxitsoftware Foxit Reader 5.1.3 Foxitsoftware Foxit Reader 5.1.4.0104 Foxitsoftware Foxit Reader 5.3 Foxitsoftware Foxit Reader 5.3.1 Foxitsoftware Foxit Reader 5.3.1.0606 Foxitsoftware Foxit Reader 5.4 Foxitsoftware Foxit Reader 5.4.3 Foxitsoftware Foxit Reader 5.4.5 Foxitsoftware Foxit Reader 6.0 Foxitsoftware Foxit Reader 6.0.3 Foxitsoftware Foxit Reader 6.0.5 Foxitsoftware Foxit Reader 6.1 Foxitsoftware Foxit Reader 6.1.2 Foxitsoftware Foxit Reader 6.1.4 Foxitsoftware Foxit Reader 6.2 Foxitsoftware Foxit Reader 6.2.1 Foxitsoftware Foxit Reader 7.0 Foxitsoftware Foxit Reader 7.0.6 Foxitsoftware Foxit Reader 7.0.6.1126 Foxitsoftware Foxit Reader 7.1 Foxitsoftware Foxit Reader 7.1.5 Foxitsoftware Foxit Reader 7.2 Foxitsoftware Foxit Reader 7.2.0.722 Foxitsoftware Foxit Reader 7.2.2 Foxitsoftware Foxit Reader 7.2.8 Foxitsoftware Foxit Reader 7.3 Foxitsoftware Foxit Reader 7.3.0.118 Foxitsoftware Foxit Reader 7.3.4 Foxitsoftware Foxit Reader 8.0 Foxitsoftware Foxit Reader 8.0.2 Foxitsoftware Foxit Reader 8.1 Foxitsoftware Foxit Reader 8.1.1 Foxitsoftware Foxit Reader 8.1.4 Foxitsoftware Foxit Reader 8.2 Foxitsoftware Phantompdf 1.0.2 Foxitsoftware Phantompdf 2.0 Foxitsoftware Phantompdf 2.1 Foxitsoftware Phantompdf 2.1.1 Foxitsoftware Phantompdf 2.2 Foxitsoftware Phantompdf 2.2.1 Foxitsoftware Phantompdf 2.2.3 Foxitsoftware Phantompdf 3.0.1 Foxitsoftware Phantompdf 5.0.2 Foxitsoftware Phantompdf 5.0.2.0721 Foxitsoftware Phantompdf 5.0.3 Foxitsoftware Phantompdf 5.0.3.0811 Foxitsoftware Phantompdf 5.1 Foxitsoftware Phantompdf 5.1.1.1214 Foxitsoftware Phantompdf 5.1.2 Foxitsoftware Phantompdf 5.1.2.0305 Foxitsoftware Phantompdf 5.2 Foxitsoftware Phantompdf 5.2.0.0502 Foxitsoftware Phantompdf 5.2.1 Foxitsoftware Phantompdf 5.2.1.0615 Foxitsoftware Phantompdf 5.4 Foxitsoftware Phantompdf 5.4.0.0902 Foxitsoftware Phantompdf 5.4.2 Foxitsoftware Phantompdf 5.4.2.0918 Foxitsoftware Phantompdf 5.4.3 Foxitsoftware Phantompdf 5.4.3.1106 Foxitsoftware Phantompdf 6.0 Foxitsoftware Phantompdf 6.0.2.0413 Foxitsoftware Phantompdf 6.0.5 Foxitsoftware Phantompdf 6.0.5.0618 Foxitsoftware Phantompdf 6.0.7 Foxitsoftware Phantompdf 6.0.7.0806 Foxitsoftware Phantompdf 6.1 Foxitsoftware Phantompdf 6.1.1.1025 Foxitsoftware Phantompdf 6.1.2 Foxitsoftware Phantompdf 6.1.2.1227 Foxitsoftware Phantompdf 6.2 Foxitsoftware Phantompdf 6.2.0.0429 Foxitsoftware Phantompdf 6.2.1 Foxitsoftware Phantompdf 6.2.1.0168 Foxitsoftware Phantompdf 7.0 Foxitsoftware Phantompdf 7.0.3.916 Foxitsoftware Phantompdf 7.0.6 Foxitsoftware Phantompdf 7.0.6.1126 Foxitsoftware Phantompdf 7.1 Foxitsoftware Phantompdf 7.1.0.306 Foxitsoftware Phantompdf 7.1.3.320 Foxitsoftware Phantompdf 7.1.5 Foxitsoftware Phantompdf 7.1.5.425 Foxitsoftware Phantompdf 7.2 Foxitsoftware Phantompdf 7.2.0.0722 Foxitsoftware Phantompdf 7.2.0.722 Foxitsoftware Phantompdf 7.2.2 Foxitsoftware Phantompdf 7.2.2.0929 Foxitsoftware Phantompdf 7.3 Foxitsoftware Phantompdf 7.3.0.0118 Foxitsoftware Phantompdf 7.3.0.118 Foxitsoftware Phantompdf 7.3.4 Foxitsoftware Phantompdf 7.3.4.0311 Foxitsoftware Phantompdf 7.3.9 Foxitsoftware Phantompdf 7.3.9.0816 Foxitsoftware Phantompdf 7.3.11 Foxitsoftware Phantompdf 7.3.11.1122 Foxitsoftware Phantompdf 7.3.13 Foxitsoftware Phantompdf 7.3.13.421 Foxitsoftware Phantompdf 7.3.15 Foxitsoftware Phantompdf 7.3.15.712 Foxitsoftware Phantompdf 7.3.17 Foxitsoftware Phantompdf 7.3.17.906 Foxitsoftware Phantompdf 8.0 Foxitsoftware Phantompdf 8.0.0.624 Foxitsoftware Phantompdf 8.0.2 Foxitsoftware Phantompdf 8.0.2.805 Foxitsoftware Phantompdf 8.1 Foxitsoftware Phantompdf 8.1.0.1013 Foxitsoftware Phantompdf 8.1.1 Foxitsoftware Phantompdf 8.1.1.1115 Foxitsoftware Phantompdf 8.2 Foxitsoftware Phantompdf 8.2.0.2192	140
OS	Microsoft Microsoft Windows *	1

Common Weakness Enumeration (CWE)

CWE-125 - Out-of-bounds Read

Common Attack Pattern Enumeration and Classification (CAPEC)

Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References