The popular software to read PDF files, Foxit Reader released a security update that patch over 100 vulnerabilities, some of them could be exploited to execute arbitrary code by remote attackers.
Foxit Reader is a multilingual freemium PDF tool that can create, view, edit, digitally sign, print PDF files and so on. That software has hundreds of millions of installations.
Foxit has released Reader 9.3 and Foxit PhantomPDF 9.3 to address security and stability issues.
Foxit Reader 9.3 addressed a lot of vulnerabilities, including out-of-bounds, use-after-free, information disclosure, type confusion, and memory corruption bugs.
The 18 vulnerabilities were found by Cisco Talos, as well as many others fixed by this update. They were labeled as critical because could lead to code execution, and attackers could create specially crafted webpages or PDFs to exploit these vulnerabilities in order to execute arbitrary code or even install malware in the vulnerable devices.
12 of the flaws could be exploited simply by visiting a web site when the Foxit PDF browser plugin is enabled.
The list of patched vulnerabilities is presented below and more information about who discovered the vulnerabilities can be found in Foxit’s security bulletin.
Pedro Tavares is a professional in the field of information security working as an Ethical Hacker/Pentester, Malware Researcher and also a Security Evangelist. He is also a founding member at CSIRT.UBI and Editor-in-Chief of the security computer blog seguranca-informatica.pt.
In recent years he has invested in the field of information security, exploring and analyzing a wide range of topics, such as pentesting (Kali Linux), malware, exploitation, hacking, IoT and security in Active Directory networks. He is also Freelance Writer (Infosec. Resources Institute and Cyber Defense Magazine) and developer of the 0xSI_f33d – a feed that compiles phishing and malware campaigns targeting Portuguese citizens.
Read more here.