his vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Decimal element. A crafted leadDigits value in a Decimal element can trigger an overflow of a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-13095.
| Link | Resource |
|---|---|
| https://www.foxitsoftware.com/support/security-bulletins.php | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-543/ | Third Party Advisory VDB Entry |
| https://www.foxitsoftware.com/support/security-bulletins.php | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-543/ | Third Party Advisory VDB Entry |
Configuration 1 (hide)
| AND |
|
21 Nov 2024, 06:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.foxitsoftware.com/support/security-bulletins.php - Vendor Advisory | |
| References | () https://www.zerodayinitiative.com/advisories/ZDI-21-543/ - Third Party Advisory, VDB Entry |
Published : 2021-05-07 21:15
Updated : 2024-11-21 06:05
NVD link : CVE-2021-31454
Mitre link : CVE-2021-31454
CVE.ORG link : CVE-2021-31454
JSON object : View
Heap-based Buffer Overflow