Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2024-9252
Analyzed
More InfoOfficial Page
Source-zdi-disclosures@trendmicro.com
View Known Exploited Vulnerability (KEV) details
Published At-22 Nov, 2024 | 22:15
Updated At-29 Nov, 2024 | 18:19

Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24491.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary3.03.3LOW
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Type: Primary
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.0
Base score: 3.3
Base severity: LOW
Vector:
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CPE Matches

Foxit Software Incorporated
foxit
>>pdf_editor>>Versions up to 11.2.10.53951(inclusive)
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*
Foxit Software Incorporated
foxit
>>pdf_editor>>Versions from 12.0(inclusive) to 12.1.7.15526(inclusive)
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*
Foxit Software Incorporated
foxit
>>pdf_editor>>Versions from 13.0(inclusive) to 13.1.3.22478(inclusive)
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*
Foxit Software Incorporated
foxit
>>pdf_editor>>Versions from 2023.0(inclusive) to 2023.3.0.23028(inclusive)
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*
Foxit Software Incorporated
foxit
>>pdf_editor>>Versions from 2024.0(inclusive) to 2024.2.3.25184(inclusive)
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:windows:*:*
Foxit Software Incorporated
foxit
>>pdf_reader>>Versions up to 2024.2.3.25184(inclusive)
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:windows:*:*
Weaknesses
CWE IDTypeSource
CWE-416Primaryzdi-disclosures@trendmicro.com
CWE ID: CWE-416
Type: Primary
Source: zdi-disclosures@trendmicro.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://www.foxit.com/support/security-bulletins.htmlzdi-disclosures@trendmicro.com
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-1304/zdi-disclosures@trendmicro.com
Third Party Advisory
Hyperlink: https://www.foxit.com/support/security-bulletins.html
Source: zdi-disclosures@trendmicro.com
Resource:
Vendor Advisory
Hyperlink: https://www.zerodayinitiative.com/advisories/ZDI-24-1304/
Source: zdi-disclosures@trendmicro.com
Resource:
Third Party Advisory
Change History
0Changes found

Details not found