HTTP: Foxit Reader ConvertToPDF BMP Out-of-Bounds Read

An out-of-bounds read vulnerability has been reported in the BMP processing component of Foxit Reader. This vulnerability is due to improper parsing of BMP files. A remote attacker could exploit this vulnerability by enticing a user to open a crafted BMP file. Successful exploitation could result in information disclosure which could be used to further compromise the target system.

Extended Description

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of BMP images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6844.

References

CVE: CVE-2018-17686

Short Name

HTTP:STC:IMG:FOXIT-BMP-OOB

Severity

Minor

Recommended

True

Recommended Action

Drop

HTTP: Foxit Reader ConvertToPDF BMP Out-of-Bounds Read

Extended Description

References

Found a potential security threat?