Vulnerability Description
An exploitable use of an uninitialized pointer vulnerability exists in the JavaScript engine in Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can lead to a dereference of an uninitialized pointer which, if under attacker control, can result in arbitrary code execution. An attacker needs to trick the user to open a malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Foxitsoftware | Foxit Reader | 9.0.1.1049 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/103942Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040733Broken LinkThird Party AdvisoryVDB Entry
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0525ExploitThird Party Advisory
- http://www.securityfocus.com/bid/103942Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040733Broken LinkThird Party AdvisoryVDB Entry
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0525ExploitThird Party Advisory
FAQ
What is CVE-2018-3842?
CVE-2018-3842 is a vulnerability with a CVSS score of 8.8 (HIGH). An exploitable use of an uninitialized pointer vulnerability exists in the JavaScript engine in Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF document can lead to a dereference of an un...
How severe is CVE-2018-3842?
CVE-2018-3842 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-3842?
Check the references section above for vendor advisories and patch information. Affected products include: Foxitsoftware Foxit Reader.