Foxit 3D Plugin Beta < RCE

High Nessus Plugin ID 139233


The remote Windows host has a Foxit plugin installed that is affected by a remote code execution vulnerability.


The version of the Foxit 3D plugin installed on the remote Windows host is prior to It is, therefore affected by an Out-of-Bounds Read/Write or Heap-based Buffer Overflow vulnerability due to improper validation of data when parsing certain file with incorrect 3D annotation data. An unauthenticated, remote attacker can exploit this to disclose information or execute remote code.


Upgrade to Foxit 3D Plugin Beta or later

See Also

Plugin Details

Severity: High

ID: 139233

File Name: foxit_3d_plugin_beta_9_7_2_29539.nasl

Version: 1.1

Type: local

Agent: windows

Family: Windows

Published: 2020/07/31

Updated: 2020/07/31

Dependencies: 132586

Risk Information

Risk Factor: High

CVSS Score Source: manual

CVSS Score Rationale: Score based on analysis of the vendor advisory.

CVSS v2.0

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3.0

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: x-cpe:/a:foxitsoftware:u3dbrowser_plugin

Required KB Items: installed_sw/Foxit U3DBrowser Plugin

Patch Publication Date: 2020/04/16

Vulnerability Publication Date: 2020/04/16