CVE-2022-32774
Description
A use-after-free vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 12.0.1.12430. By prematurely deleting objects associated with pages, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Risk Information
Base Score
7.8
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.531
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (EXE) (11.2.4.53774) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (ML) (MSI) (11.2.4.53774) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (EXE) (11.2.4.53774) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 11 (MSI) (11.2.4.53774) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 12 (ML) (EXE) (12.0.2.12465) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 12 (ML) (MSI) (12.0.2.12465) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 12 (EXE) (12.0.2.12465) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 12 (MSI) (12.0.2.12465) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 12 (ML) (EXE) (12.1.1.15289) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 12 (ML) (MSI) (12.1.1.15289) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 12 (EXE) (12.1.1.15289) | Windows |
| Multiple vulnerabilities are fixed in Foxit PDF Editor 12 (MSI) (12.1.1.15289) | Windows |
| Multiple vulnerabilities are fixed in Foxit PhantomPDF 10 (EXE) (10.1.10.37854) | Windows |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-330913 | Foxit PDF Editor 11 (ML) (EXE) (11.2.6.53790) |
| PATCH-330914 | Foxit PDF Editor 11 (ML) (MSI) (11.2.6.53790) |
| PATCH-330912 | Foxit PDF Editor 11 (EXE) (11.2.6.53790) |
| PATCH-330915 | Foxit PDF Editor 11 (MSI) (11.2.6.53790) |
| PATCH-330270 | Foxit PDF Editor 12 (ML) (EXE) (12.1.2.15332) |
| PATCH-330271 | Foxit PDF Editor 12 (ML) (MSI) (12.1.2.15332) |
| PATCH-330269 | Foxit PDF Editor 12 (EXE) (12.1.2.15332) |
| PATCH-330272 | Foxit PDF Editor 12 (MSI) (12.1.2.15332) |
| PATCH-331791 | Foxit PDF Editor 12 (ML) (EXE) (12.1.3.15356) |
| PATCH-331792 | Foxit PDF Editor 12 (ML) (MSI) (12.1.3.15356) |
| PATCH-331790 | Foxit PDF Editor 12 (EXE) (12.1.3.15356) |
| PATCH-331793 | Foxit PDF Editor 12 (MSI) (12.1.3.15356) |
| PATCH-331212 | Foxit PhantomPDF 10 (EXE) (10.1.12.37872) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234