CVE-2017-5556
HighSummary
The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image.
Risk Assessment
The vulnerability could lead to information disclosure; an attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.
Recommendation
It is recommended to update Foxit Reader and PhantomPDF to version 8.2 or later and to disable the gflags app to minimize risk.
Other vulnerabilities in Foxit Reader, PhantomPDF
See all- CVE-2017-10994High
Foxit Reader before version 8.3.1 and PhantomPDF before version 8.3.1 have an Arbitrary Write vulnerability, allowing remote attackers to execute arbitrary code via a crafted document.
- CVE-2017-8455High
Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 have an out-of-bounds read that allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted font in a PDF document.
- CVE-2017-8454High
Foxit Reader before version 8.2.1 and PhantomPDF before version 8.2.1 have an out-of-bounds read vulnerability that allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted font in a PDF document.
- CVE-2017-8453High
Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 have an out-of-bounds read that allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted font in a PDF document.
- CVE-2016-8878High
An out-of-bounds read vulnerability in Foxit Reader and PhantomPDF before version 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document.
- CVE-2016-8877High
CVE-2016-8877 is a heap buffer overflow (Out-of-Bounds write) vulnerability in Foxit Reader and PhantomPDF before version 8.1 on Windows. It allows remote attackers to execute arbitrary code via a crafted JPEG2000 image embedded in a PDF document.
- CVE-2016-8876High
Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before version 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted TIFF image embedded in the XFA stream in a PDF document.
- CVE-2016-4064High
CVE-2016-4064 is a use-after-free vulnerability in the XFA forms handling functionality in Foxit Reader and PhantomPDF before version 7.3.4 on Windows. It allows remote attackers to execute arbitrary code via a crafted remerge call.
- CVE-2016-4063High
Use-after-free vulnerability in Foxit Reader and PhantomPDF before version 7.3.4 on Windows allows remote attackers to execute arbitrary code via an object with a revision number of -1 in a PDF document.
- CVE-2016-4061High
Foxit Reader and PhantomPDF before version 7.3.4 on Windows allow remote attackers to cause application crashes via a crafted content stream.
Original NVD description (English source)
The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image. The vulnerability could lead to information disclosure; an attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.