Lucene search

MitreCVE-2018-19343

HistoryNov 17, 2018 - 9:29 p.m.

CVE-2018-19343

2018-11-1721:29:00

CWE-125

mitre

web.nvd.nist.gov

u3d plugin

foxitreader

cve-2018-19343

denial of service

out-of-bounds read

sensitive information

remote attackers

nvd

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

42.6%

JSON

The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a “Data from Faulting Address controls Code Flow starting at U3DBrowser!PlugInMain+0x00000000000f43ff” issue.

Affected configurations

Nvd

Node

foxitsoftwarefoxit_readerMatch9.3.0.10826

foxitsoftwareu3dMatch9.3.0.10809

VendorProductVersionCPE
foxitsoftwarefoxit_reader9.3.0.10826cpe:2.3:a:foxitsoftware:foxit_reader:9.3.0.10826:*:*:*:*:*:*:*
foxitsoftwareu3d9.3.0.10809cpe:2.3:a:foxitsoftware:u3d:9.3.0.10809:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
foxitsoftware	foxit_reader	9.3.0.10826	cpe:2.3:a:foxitsoftware:foxit_reader:9.3.0.10826:::::::*
foxitsoftware	u3d	9.3.0.10809	cpe:2.3:a:foxitsoftware:u3d:9.3.0.10809:::::::*

References

github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html

www.foxitsoftware.com/support/security-bulletins.php

yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

42.6%

JSON

Related for CVE-2018-19343