7.1

CVE-2018-3956

Exploit
An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger an out-of-bounds read, which can disclose sensitive memory content and aid in exploitation when coupled with another vulnerability. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Foxitsoftware ≫ Phantompdf Version <= 9.3.0.10826
   Microsoft ≫ Windows Version -
Foxitsoftware ≫ Reader Version <= 9.3.0.10826
   Microsoft ≫ Windows Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 46.01% 0.987
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:N/A:P
Cisco Talos 6.8 1.6 5.2
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0626
Third Party Advisory
Exploit