CVE-2018-9948 : This vulnerability allows remote attackers to disclose sensitive information on

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of typed arrays. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5380.

Published 2018-05-17 15:29:02

Updated 2019-10-09 23:43:23

Source Zero Day Initiative

View at NVD, CVE.org

Vulnerability category: Execute codeInformation leak

Products affected by CVE-2018-9948

Foxitsoftware » Foxit Reader
Versions up to, including, (<=) 9.0.1.1049
cpe:2.3:a:foxitsoftware:foxit_reader:*:*:*:*:*:*:*:*
Matching versions
Foxitsoftware » Phantompdf
Versions up to, including, (<=) 9.0.1.1049
cpe:2.3:a:foxitsoftware:phantompdf:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-9948

EPSS FAQ

87.83%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2018-9948

Foxit PDF Reader Pointer Overwrite UAF

Disclosure Date: 2018-04-20

First seen: 2020-04-26

exploit/windows/fileformat/foxit_reader_uaf

Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability in the Text Annotations component and the TypedArray's use uninitialized pointers. The vulnerabilities can be combined to leak a vtable memory address, which can be adjusted to point to the base

More information

CVSS scores for CVE-2018-9948

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2018-9948

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)
CWE-824 Access of Uninitialized Pointer

The product accesses or uses a pointer that has not been initialized.

Assigned by: zdi-disclosures@trendmicro.com (Secondary)

References for CVE-2018-9948

https://zerodayinitiative.com/advisories/ZDI-18-332

ZDI-18-332 | Zero Day Initiative
Third Party Advisory;VDB Entry
https://www.foxitsoftware.com/support/security-bulletins.php

Security Bulletins | Foxit Software
Patch;Vendor Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/44941/

Foxit Reader 9.0.1.1049 - Remote Code Execution
Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.exploit-db.com/exploits/45269/

Foxit PDF Reader 9.0.1.1049 - Pointer Overwrite Use-After-Free (Metasploit)
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to