CVE-2021-21831
Description
A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 10.1.3.37598. A specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Risk Information
Base Score
8.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.864
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities fixed in Foxit PhantomPDF 10 (ML) (EXE) (10.1.5.37672) | Windows |
| Multiple vulnerabilities fixed in Foxit PhantomPDF 10 (ML) (MSI) (10.1.5.37672) | Windows |
| Multiple vulnerabilities fixed in Foxit PhantomPDF 10 (MSI) (10.1.5.37672) | Windows |
| Multiple vulnerabilities fixed in Foxit PhantomPDF 10 (EXE) (10.1.5.37672) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (EXE) (11.1.0.52543) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (MSI) (11.1.0.52543) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (EXE) (11.1.0.52543) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (MSI) (11.1.0.52543) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (EXE) (11.0.1.49938) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (MSI) (11.0.1.49938) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (EXE) (11.0.1.49938) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (MSI) (11.0.1.49938) | Windows |
| Vulnerabilities CVE-2021-21831,CVE-2021-34832,CVE-2021-21893,CVE-2021-34846 are fixed in Foxit PDF Editor 11 (ML) (EXE) (11.0.1.49938) | Windows |
| Vulnerabilities CVE-2021-21831,CVE-2021-34832,CVE-2021-21893,CVE-2021-34846 are fixed in Foxit PDF Editor 11 (ML) (MSI) (11.0.1.49938) | Windows |
| Vulnerabilities CVE-2021-21831,CVE-2021-34832,CVE-2021-21893,CVE-2021-34846 are fixed in Foxit PDF Editor 11 (EXE) (11.0.1.49938) | Windows |
| Vulnerabilities CVE-2021-21831,CVE-2021-34832,CVE-2021-21893,CVE-2021-34846 are fixed in Foxit PDF Editor 11 (MSI) (11.0.1.49938) | Windows |
| Multiple vulnerabilities are fixed in Foxit PhantomPDF 10 (EXE) (10.1.5.37672) | Windows |
| Multiple vulnerabilities are fixed in Foxit PhantomPDF 10 (MSI) (10.1.5.37672) | Windows |
| Multiple vulnerabilities are fixed in Foxit PhantomPDF 10 (ML) (EXE) (10.1.5.37672) | Windows |
| Multiple vulnerabilities are fixed in Foxit PhantomPDF 10 (ML) (MSI) (10.1.5.37672) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (EXE) (11.0.1.49938) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (MSI) (11.0.1.49938) | Windows |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-321160 | Foxit PhantomPDF 10 (ML) (EXE) (10.1.5.37672) |
| PATCH-321161 | Foxit PhantomPDF 10 (ML) (MSI) (10.1.5.37672) |
| PATCH-321162 | Foxit PhantomPDF 10 (MSI) (10.1.5.37672) |
| PATCH-321159 | Foxit PhantomPDF 10 (EXE) (10.1.5.37672) |
| PATCH-330913 | Foxit PDF Editor 11 (ML) (EXE) (11.2.6.53790) |
| PATCH-330914 | Foxit PDF Editor 11 (ML) (MSI) (11.2.6.53790) |
| PATCH-330912 | Foxit PDF Editor 11 (EXE) (11.2.6.53790) |
| PATCH-330915 | Foxit PDF Editor 11 (MSI) (11.2.6.53790) |
| PATCH-321158 | Foxit PDF Editor 11 (ML) (MSI) (11.0.1.49938) |
| PATCH-343981 | Foxit PDF Editor 11 (EXE) (11.2.12.54161) |
| PATCH-321157 | Foxit PDF Editor 11 (MSI) (11.0.1.49938) |
| PATCH-333320 | Foxit PDF Editor 11 (ML) (EXE) (11.2.7.53812) |
| PATCH-333321 | Foxit PDF Editor 11 (ML) (MSI) (11.2.7.53812) |
| PATCH-333323 | Foxit PDF Editor 11 (EXE) (11.2.7.53812) |
| PATCH-333322 | Foxit PDF Editor 11 (MSI) (11.2.7.53812) |
| PATCH-331212 | Foxit PhantomPDF 10 (EXE) (10.1.12.37872) |
| PATCH-331215 | Foxit PhantomPDF 10 (MSI) (10.1.12.37872) |
| PATCH-331213 | Foxit PhantomPDF 10 (ML) (EXE) (10.1.12.37872) |
| PATCH-331214 | Foxit PhantomPDF 10 (ML) (MSI) (10.1.12.37872) |
| PATCH-343982 | Foxit PDF Editor 11 (ML) (EXE) (11.2.12.54161) |
| PATCH-343983 | Foxit PDF Editor 11 (ML) (MSI) (11.2.12.54161) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234