Vulnerabilities > CVE-2018-3995 - Use After Free vulnerability in Foxitsoftware Phantompdf

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
foxitsoftware
CWE-416
nessus
NVD
Published: 2018-10-03
Updated: 2023-02-02

Summary

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Vulnerable Configurations

Part Description Count
Application
Foxitsoftware
191
OS
Microsoft
1

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyWindows
    NASL idFOXIT_PHANTOM_8_3_8.NASL
    descriptionAccording to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.3.7. It is, therefore, affected by multiple arbitrary code execution and information disclosure vulnerabilities.
    last seen2020-04-30
    modified2018-11-30
    plugin id119309
    published2018-11-30
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119309
    titleFoxit PhantomPDF < 8.3.8 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(119309);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/27");

  script_cve_id(
    "CVE-2018-3940",
    "CVE-2018-3941",
    "CVE-2018-3942",
    "CVE-2018-3943",
    "CVE-2018-3944",
    "CVE-2018-3945",
    "CVE-2018-3946",
    "CVE-2018-3957",
    "CVE-2018-3958",
    "CVE-2018-3959",
    "CVE-2018-3960",
    "CVE-2018-3961",
    "CVE-2018-3962",
    "CVE-2018-3964",
    "CVE-2018-3965",
    "CVE-2018-3966",
    "CVE-2018-3967",
    "CVE-2018-3992",
    "CVE-2018-3993",
    "CVE-2018-3994",
    "CVE-2018-3995",
    "CVE-2018-3996",
    "CVE-2018-3997",
    "CVE-2018-16291",
    "CVE-2018-16292",
    "CVE-2018-16293",
    "CVE-2018-16294",
    "CVE-2018-16295",
    "CVE-2018-16296",
    "CVE-2018-16297",
    "CVE-2018-17781"
  );

  script_name(english:"Foxit PhantomPDF < 8.3.8 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of Foxit PhantomPDF.");

  script_set_attribute(attribute:"synopsis", value:
"A PDF toolkit installed on the remote Windows host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its version, the Foxit PhantomPDF application (formally
known as Phantom) installed on the remote Windows host is prior to
8.3.7. It is, therefore, affected by multiple arbitrary code execution
and information disclosure vulnerabilities.");
  script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Foxit PhantomPDF version 8.3.8 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-3940");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/08/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("foxit_phantom_installed.nasl");
  script_require_keys("installed_sw/FoxitPhantomPDF");

  exit(0);
}

include('vcf.inc');

app = 'FoxitPhantomPDF';

app_info = vcf::get_app_info(app:app, win_local:TRUE);

constraints = [{
  'min_version' : '8.0',
  'max_version' : '8.3.7.38093',
  'fixed_version' : '8.3.8'
  }];


vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
  • NASL familyWindows
    NASL idFOXIT_PHANTOM_8_3_7.NASL
    descriptionAccording to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.3.7. It is, therefore, affected by multiple arbitrary code execution and information disclosure vulnerabilities.
    last seen2020-04-30
    modified2018-11-30
    plugin id119308
    published2018-11-30
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119308
    titleFoxit PhantomPDF < 8.3.7 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(119308);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/27");

  script_cve_id(
    "CVE-2018-3940",
    "CVE-2018-3941",
    "CVE-2018-3942",
    "CVE-2018-3943",
    "CVE-2018-3944",
    "CVE-2018-3945",
    "CVE-2018-3946",
    "CVE-2018-3957",
    "CVE-2018-3958",
    "CVE-2018-3959",
    "CVE-2018-3960",
    "CVE-2018-3961",
    "CVE-2018-3962",
    "CVE-2018-3964",
    "CVE-2018-3965",
    "CVE-2018-3966",
    "CVE-2018-3967",
    "CVE-2018-3992",
    "CVE-2018-3993",
    "CVE-2018-3994",
    "CVE-2018-3995",
    "CVE-2018-3996",
    "CVE-2018-3997",
    "CVE-2018-16291",
    "CVE-2018-16292",
    "CVE-2018-16293",
    "CVE-2018-16294",
    "CVE-2018-16295",
    "CVE-2018-16296",
    "CVE-2018-16297",
    "CVE-2018-17781"
  );

  script_name(english:"Foxit PhantomPDF < 8.3.7 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of Foxit PhantomPDF.");

  script_set_attribute(attribute:"synopsis", value:
"A PDF toolkit installed on the remote Windows host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its version, the Foxit PhantomPDF application (formally
known as Phantom) installed on the remote Windows host is prior to
8.3.7. It is, therefore, affected by multiple arbitrary code execution
and information disclosure vulnerabilities.");
  script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Foxit PhantomPDF version 8.3.7 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-3940");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/08/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("foxit_phantom_installed.nasl");
  script_require_keys("installed_sw/FoxitPhantomPDF");

  exit(0);
}

include('vcf.inc');

app = 'FoxitPhantomPDF';

app_info = vcf::get_app_info(app:app, win_local:TRUE);

constraints = [{
  'min_version' : '8.0',
  'max_version' : '8.3.6.35572',
  'fixed_version' : '8.3.7'
  }];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);

Talos

idTALOS-2018-0663
last seen2019-05-29
published2018-10-01
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0663
titleFoxit PDF Reader JavaScript Field object signatureInfo remote code execution vulnerability

References