Kpc

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier Description: The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, where a victim must open a malicious file. Recommendations: For versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier, update to a version that fixes the out-of-bounds read vulnerability to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier Description: The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, where a victim must open a malicious file. Recommendations: For versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier, update to a version that fixes this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to an access of uninitialized pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file. The vulnerability is associated with the use of an uninitialized pointer when processing the `itemVariationDataCount` field.

A use-after-free vulnerability exists in the way Foxit Reader handles a 3D page object. This can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory corruption and potentially resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site when the browser plugin extension is enabled.

A use-after-free vulnerability exists in the way Foxit Reader handles a checkbox `CBF Widget` object. This vulnerability can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory corruption and potentially resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site with the browser plugin extension enabled.

The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file.

The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file.

The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file.

A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build. The vulnerability occurs during Anka node agent update, allowing a low privilege user to trigger the issue. A specially crafted PKG file can lead to the execution of privileged operations. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. The issue is due to a Time-of-Check-to-Time-of-Use (TOCTOU) attack, where the downloaded package can be replaced with a malicious one before installation.

A directory traversal vulnerability exists in the archive functionality of Veertu Anka. This vulnerability can be triggered by a specially crafted HTTP request, potentially leading to the disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to exploit this issue.

A directory traversal vulnerability exists in the log files download functionality. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file, specifically a PDF document containing JavaScript code. This allows a remote attacker to execute arbitrary code.

The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file. This vulnerability allows attackers to memory leak.

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier Description: The issue is related to an out-of-bounds read vulnerability in the CoolType font processing framework of Acrobat Reader. This vulnerability can be exploited by an attacker using a specially crafted PDF file with an embedded malicious font file, potentially allowing the disclosure of sensitive memory information. The exploitation of this issue requires user interaction, such as opening a malicious file, and could enable an attacker to bypass certain security mitigations. Recommendations: For versions 20.005.30636, 24.002.20965, 24.002.20964, and 24.001.30123, update to a version that is not affected by this issue. For all versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider avoiding the use of potentially malicious PDF files until a patch is available. Restrict access to untrusted PDF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises when the timing of actions changes the state of a resource between the checking of a condition and the use of the resource, allowing an attacker to manipulate the resource in a harmful way. Exploitation of this issue requires user interaction in that a victim must open a malicious file. The vulnerability is also associated with errors in synchronization when using a shared resource, which can be described as a "race condition".

A privilege escalation issue exists due to improper certification validation of the updater executable before executing it. This allows a low privilege user to trigger the update action, potentially resulting in unexpected elevation of privilege.

The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, where a victim must open a malicious file. This allows an attacker to potentially leak memory.

The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file.

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 2024.1.0.23997 Description: A use-after-free vulnerability exists in the way Foxit Reader handles a Barcode widget. A specially crafted JavaScript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Recommendations: For Foxit Reader version 2024.1.0.23997, update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the browser plugin extension to minimize the risk of exploitation. Avoid opening malicious PDF documents from untrusted sources. Restrict access to untrusted websites to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 2024.1.0.23997 Description: A type confusion vulnerability exists in the way Foxit Reader handles a Lock object. This can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory corruption and potentially resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Recommendations: For Foxit Reader version 2024.1.0.23997, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, avoid opening malicious PDF documents and restrict access to untrusted websites, especially if the browser plugin extension is enabled.