Vulnerabilities > CVE-2018-3961 - Use After Free vulnerability in Foxitsoftware Phantompdf

047910
CVSS 7.8 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
foxitsoftware
CWE-416
nessus

Summary

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. A use-after-free condition can occur when accessing the Creator property of the this.info object. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Vulnerable Configurations

Part Description Count
Application
Foxitsoftware
191
OS
Microsoft
1

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyWindows
    NASL idFOXIT_PHANTOM_8_3_8.NASL
    descriptionAccording to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.3.7. It is, therefore, affected by multiple arbitrary code execution and information disclosure vulnerabilities.
    last seen2020-04-30
    modified2018-11-30
    plugin id119309
    published2018-11-30
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119309
    titleFoxit PhantomPDF < 8.3.8 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(119309);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/27");
    
      script_cve_id(
        "CVE-2018-3940",
        "CVE-2018-3941",
        "CVE-2018-3942",
        "CVE-2018-3943",
        "CVE-2018-3944",
        "CVE-2018-3945",
        "CVE-2018-3946",
        "CVE-2018-3957",
        "CVE-2018-3958",
        "CVE-2018-3959",
        "CVE-2018-3960",
        "CVE-2018-3961",
        "CVE-2018-3962",
        "CVE-2018-3964",
        "CVE-2018-3965",
        "CVE-2018-3966",
        "CVE-2018-3967",
        "CVE-2018-3992",
        "CVE-2018-3993",
        "CVE-2018-3994",
        "CVE-2018-3995",
        "CVE-2018-3996",
        "CVE-2018-3997",
        "CVE-2018-16291",
        "CVE-2018-16292",
        "CVE-2018-16293",
        "CVE-2018-16294",
        "CVE-2018-16295",
        "CVE-2018-16296",
        "CVE-2018-16297",
        "CVE-2018-17781"
      );
    
      script_name(english:"Foxit PhantomPDF < 8.3.8 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Foxit PhantomPDF.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A PDF toolkit installed on the remote Windows host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its version, the Foxit PhantomPDF application (formally
    known as Phantom) installed on the remote Windows host is prior to
    8.3.7. It is, therefore, affected by multiple arbitrary code execution
    and information disclosure vulnerabilities.");
      script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Foxit PhantomPDF version 8.3.8 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-3940");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/02");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/30");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("foxit_phantom_installed.nasl");
      script_require_keys("installed_sw/FoxitPhantomPDF");
    
      exit(0);
    }
    
    include('vcf.inc');
    
    app = 'FoxitPhantomPDF';
    
    app_info = vcf::get_app_info(app:app, win_local:TRUE);
    
    constraints = [{
      'min_version' : '8.0',
      'max_version' : '8.3.7.38093',
      'fixed_version' : '8.3.8'
      }];
    
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyWindows
    NASL idFOXIT_PHANTOM_8_3_7.NASL
    descriptionAccording to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.3.7. It is, therefore, affected by multiple arbitrary code execution and information disclosure vulnerabilities.
    last seen2020-04-30
    modified2018-11-30
    plugin id119308
    published2018-11-30
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119308
    titleFoxit PhantomPDF < 8.3.7 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(119308);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/27");
    
      script_cve_id(
        "CVE-2018-3940",
        "CVE-2018-3941",
        "CVE-2018-3942",
        "CVE-2018-3943",
        "CVE-2018-3944",
        "CVE-2018-3945",
        "CVE-2018-3946",
        "CVE-2018-3957",
        "CVE-2018-3958",
        "CVE-2018-3959",
        "CVE-2018-3960",
        "CVE-2018-3961",
        "CVE-2018-3962",
        "CVE-2018-3964",
        "CVE-2018-3965",
        "CVE-2018-3966",
        "CVE-2018-3967",
        "CVE-2018-3992",
        "CVE-2018-3993",
        "CVE-2018-3994",
        "CVE-2018-3995",
        "CVE-2018-3996",
        "CVE-2018-3997",
        "CVE-2018-16291",
        "CVE-2018-16292",
        "CVE-2018-16293",
        "CVE-2018-16294",
        "CVE-2018-16295",
        "CVE-2018-16296",
        "CVE-2018-16297",
        "CVE-2018-17781"
      );
    
      script_name(english:"Foxit PhantomPDF < 8.3.7 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Foxit PhantomPDF.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A PDF toolkit installed on the remote Windows host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its version, the Foxit PhantomPDF application (formally
    known as Phantom) installed on the remote Windows host is prior to
    8.3.7. It is, therefore, affected by multiple arbitrary code execution
    and information disclosure vulnerabilities.");
      script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Foxit PhantomPDF version 8.3.7 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-3940");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/16");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/30");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("foxit_phantom_installed.nasl");
      script_require_keys("installed_sw/FoxitPhantomPDF");
    
      exit(0);
    }
    
    include('vcf.inc');
    
    app = 'FoxitPhantomPDF';
    
    app_info = vcf::get_app_info(app:app, win_local:TRUE);
    
    constraints = [{
      'min_version' : '8.0',
      'max_version' : '8.3.6.35572',
      'fixed_version' : '8.3.7'
      }];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyWindows
    NASL idFOXIT_PHANTOM_9_3.NASL
    descriptionAccording to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 9.3. It is, therefore, affected by multiple vulnerabilities.
    last seen2020-04-30
    modified2018-10-12
    plugin id118092
    published2018-10-12
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118092
    titleFoxit PhantomPDF < 9.3 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(118092);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/27");
    
      script_cve_id(
        "CVE-2018-3940",
        "CVE-2018-3941",
        "CVE-2018-3942",
        "CVE-2018-3943",
        "CVE-2018-3944",
        "CVE-2018-3945",
        "CVE-2018-3946",
        "CVE-2018-3957",
        "CVE-2018-3958",
        "CVE-2018-3959",
        "CVE-2018-3960",
        "CVE-2018-3961",
        "CVE-2018-3962",
        "CVE-2018-3964",
        "CVE-2018-3965",
        "CVE-2018-3966",
        "CVE-2018-3967",
        "CVE-2018-3992",
        "CVE-2018-17781"
      );
    
      script_name(english:"Foxit PhantomPDF < 9.3 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Foxit PhantomPDF.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A PDF toolkit installed on the remote Windows host is affected by
    a multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its version, the Foxit PhantomPDF application (formally
    known as Phantom) installed on the remote Windows host is prior to
    9.3. It is, therefore, affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Foxit PhantomPDF version 9.3 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-3940");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/09/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/12");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("foxit_phantom_installed.nasl");
      script_require_keys("installed_sw/FoxitPhantomPDF");
    
      exit(0);
    }
    
    include('vcf.inc');
    
    app = 'FoxitPhantomPDF';
    
    app_info = vcf::get_app_info(app:app, win_local:TRUE);
    
    constraints = [{
      'min_version' : '9.0',
      'max_version' : '9.2.0.9297',
      'fixed_version' : '9.3'
      }];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyWindows
    NASL idFOXIT_READER_9_3.NASL
    descriptionThe version of Foxit Reader installed on the remote Windows host is prior to 9.3. It is, therefore, affected by multiple vulnerabilities.
    last seen2020-04-30
    modified2018-10-12
    plugin id118093
    published2018-10-12
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118093
    titleFoxit Reader < 9.3 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(118093);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/27");
    
      script_cve_id(
        "CVE-2018-3940",
        "CVE-2018-3941",
        "CVE-2018-3942",
        "CVE-2018-3943",
        "CVE-2018-3944",
        "CVE-2018-3945",
        "CVE-2018-3946",
        "CVE-2018-3957",
        "CVE-2018-3958",
        "CVE-2018-3959",
        "CVE-2018-3960",
        "CVE-2018-3961",
        "CVE-2018-3962",
        "CVE-2018-3964",
        "CVE-2018-3965",
        "CVE-2018-3966",
        "CVE-2018-3967",
        "CVE-2018-3992",
        "CVE-2018-17781"
      );
    
      script_name(english:"Foxit Reader < 9.3 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Foxit Reader.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A PDF viewer installed on the remote Windows host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Foxit Reader installed on the remote Windows host is
    prior to 9.3. It is, therefore, affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Foxit PhantomPDF version 9.3 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-3940");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/09/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/12");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:foxit_reader");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("foxit_reader_installed.nasl");
      script_require_keys("installed_sw/Foxit Reader");
    
      exit(0);
    }
    
    include('vcf.inc');
    
    app = 'Foxit Reader';
    
    app_info = vcf::get_app_info(app:app, win_local:TRUE);
    
    constraints = [{
      'min_version' : '9.0',
      'max_version' : '9.2.0.9297',
      'fixed_version' : '9.3'
      }];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    

Talos

idTALOS-2018-0628
last seen2019-05-29
published2018-10-01
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0628
titleFoxit PDF Reader JavaScript this.info multiple remote code execution vulnerabilities