CVE-2009-0836

2009-03-1020:30:06

CWE-119

mitre

web.nvd.nist.gov

foxit reader

cve-2009-0836

pdf

security vulnerability

remote execution

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.6

Confidence

High

EPSS

0.067

Percentile

93.9%

JSON

Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before performing dangerous actions defined in a PDF file, which allows remote attackers to execute arbitrary programs and have unspecified other impact via a crafted file, as demonstrated by the “Open/Execute a file” action.

Affected configurations

Nvd

Node

foxitsoftwarereaderMatch2.3

foxitsoftwarereaderMatch3.0

VendorProductVersionCPE
foxitsoftwarereader2.3cpe:2.3:a:foxitsoftware:reader:2.3:*:*:*:*:*:*:*
foxitsoftwarereader3.0cpe:2.3:a:foxitsoftware:reader:3.0:*:*:*:*:*:*:*