A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.0.0.49893. A specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.

According to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 10.1.5. It is, therefore affected by multiple vulnerabilities:

  - This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit     PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target     must visit a malicious page or open a malicious file. The specific flaw exists within the handling of     Annotation objects. The issue results from the lack of validating the existence of an object prior to     performing operations on the object. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-14013. (CVE-2021-34853)

  - A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version     10.1.4.37651. A specially crafted PDF document can trigger the reuse of previously free memory, which can     lead to arbitrary code execution. An attacker needs to trick the user into opening a malicious file or     site to trigger this vulnerability if the browser plugin extension is enabled. (CVE-2021-21870)

  - A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version     11.0.0.49893. A specially crafted PDF document can trigger the reuse of previously freed memory, which can     lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to     trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious     site if the browser plugin extension is enabled. (CVE-2021-21893)

  - This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit     Reader 10.1.4.37651. User interaction is required to exploit this vulnerability in that the target must     visit a malicious page or open a malicious file. The specific flaw exists within the handling of Document     objects. The issue results from the lack of validating the existence of an object prior to performing     operations on the object. An attacker can leverage this vulnerability to execute code in the context of     the current process. Was ZDI-CAN-13741. (CVE-2021-34831)

  - This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit     PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target     must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the     delay property. The issue results from the lack of validating the existence of an object prior to     performing operations on the object. An attacker can leverage this vulnerability to execute code in the     context of the current process. Was ZDI-CAN-13928. (CVE-2021-34832)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its version, the Foxit PDF Editor application (formally known as PhantomPDF) installed on the remote Windows host is prior to 11.0.1. It is, therefore affected by multiple vulnerabilities:

  - Multiple remote code execution vulnerabilities exist in Foxit PDF Editor due to a use-after-free error     when handling certain Javascripts and annotation objects. An unauthenticated, remote attacker can exploit     these, by convincing a user to open a malicious document, to execute arbitrary code in the context of the     current user. (CVE-2021-21831, CVE-2021-21870, CVE-2021-34831, CVE-2021-34832, CVE-2021-34847,     CVE-2021-34848, CVE-2021-34849, CVE-2021-34850)

  - Multiple remote code execution vulnerabilities exist in Foxit PDF Editor due to a use-after-free error     when handling the annotation objects in certain PDF files if the same annotation dictionary is referenced     in the page structures for different pages. An unauthenticated, remote attacker can exploit these, by     convincing a user to open a malicious document, to execute arbitrary code in the context of the current     user. (CVE-2021-34833, CVE-2021-34834, CVE-2021-34835, CVE-2021-34836, CVE-2021-34837, CVE-2021-34838,     CVE-2021-34839, CVE-2021-34840, CVE-2021-34841, CVE-2021-34842, CVE-2021-34843, CVE-2021-34844,     CVE-2021-34845, CVE-2021-34851, CVE-2021-34852, CVE-2021-34853)

  - A remote code execution vulnerability exists in Foxit PDF Editor due to a use-after-free error when     handling certain events of form elements. An unauthenticated, remote attacker can exploit these, by     convincing a user to open a malicious document, to execute arbitrary code in the context of the current     user. (CVE-2021-21893)

  - A remote code execution vulnerability exists in Foxit PDF Editor due to a use-after-free errror when     traversing bookmark nodes in certain PDF files. An unauthenticated, remote attacker can exploit these, by     convincing a user to open a malicious document, to execute arbitrary code in the context of the current     user. (CVE-2021-34846)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Foxit PDF Editor for Mac (previously named Foxit PhantomPDF for Mac) installed on the remote macOS host is prior to 11.0.1. It is, therefore, affected by multiple vulnerabilities:

  - Multiple remote code execution vulnerabilities exist in Foxit PDF Editor due to use-after-free errors when     handling certain Javascripts. An unauthenticated, remote attacker can exploit these, by convincing a user     to open a malicious file or visit a malicious site with the browser plugin extension enabled, to cause     execute arbitrary code in the context of the current user. (CVE-2021-21831, CVE-2021-34832)

  - A remote code execution vulnerability exists in Foxit PDF Editor due to a use-after-free error when     handling certain form elements. An unauthenticated, remote attacker can exploit this, by convincing a user     to open a malicious file or visit a malicious site with the browser plugin extension enabled, to execute     arbitrary code in the context of the current user. (CVE-2021-21893)

  - A remote code execution vulnerability exists in Foxit PDF Editor due to a use-after-free error in handling     certain annotation objects. An unauthenticated, remote attacker can exploit this, by convincing a user to     open a malicious file or visit a malicious site with the browser plugin extension enabled, to execute     arbitrary code in the context of the current user. (CVE-2021-34846)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Foxit PDF Reader for Mac installed on the remote macOS host is prior to 11.0.1. It is, therefore, affected by multiple vulnerabilities:

  - Multiple remote code execution vulnerabilities exist in Foxit PDF Reader due to use-after-free errors when     handling certain Javascripts. An unauthenticated, remote attacker can exploit these, by convincing a user     to open a malicious file or visit a malicious site with the browser plugin extension enabled, to cause     execute arbitrary code in the context of the current user. (CVE-2021-21831, CVE-2021-34832)

  - A remote code execution vulnerability exists in Foxit PDF Reader due to a use-after-free error when     handling certain form elements. An unauthenticated, remote attacker can exploit this, by convincing a user     to open a malicious file or visit a malicious site with the browser plugin extension enabled, to execute     arbitrary code in the context of the current user. (CVE-2021-21893)

  - A remote code execution vulnerability exists in Foxit PDF Reader due to a use-after-free error in handling     certain annotation objects. An unauthenticated, remote attacker can exploit this, by convincing a user to     open a malicious file or visit a malicious site with the browser plugin extension enabled, to execute     arbitrary code in the context of the current user. (CVE-2021-34846)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its version, the Foxit Reader application installed on the remote Windows host is prior to 11.0.1. It is, therefore affected by multiple arbitrary code execution vulnerabilities due to a use-after-free flaw in the JavaScript engine. An authenticated, local attacker can exploit this by persuading a victim to open a specially-crafted PDF file, to execute arbitrary code on the system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
152861	Foxit PhantomPDF < 10.1.5 Multiple Vulnerabilities	Nessus	Windows	Local	critical
152220	Foxit PDF Editor (PhantomPDF) < 11.0.1 Multiple Vulnerabilities	Nessus	Windows	Local	critical
152211	Foxit PDF Editor < 11.0.1 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	high
152210	Foxit PDF Reader < 11.0.1 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	high
152161	Foxit Reader < 11.0.1 Multiple Vulnerabilities	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2021-21893

high

Tenable Plugins

critical

critical

high

high

critical