For Foxit's sake: Windows and Mac users alike urged to patch PhantomPDF over use-after-free vulns
- Reference: 1602610221
- News link: https://www.theregister.co.uk/2020/10/13/foxit_phantompdf_vulns_update/
- Source link:
In its latest regular threat report, CISA counted four CVSS v2 7.5-level vulns affecting PhantomPDF.
The software suite is widely used for manipulating PDFs, particularly by people whom, for whatever reason, eschew Adobe's products and pricing model.
Foxit has published updates for its software in both Windows and Apple Mac formats. Those readers running versions prior to 10.1 for Windows and version 4.1 for Mac ought to download and install them [1]from Foxit's website .
The four most recent vulns range from [2]use-after-free snafus to out-of-bounds memory writes and read/write access violations.
Foxit's patch notes stated, for one of the vulns: "Addressed a potential issue where the application could be exposed to Use-After-Free vulnerability and crash when executing JavaScript in certain AcroForm. This occurs due to the use of Opt object after it has been deleted by calling Field::ClearItems method while executing Field::DeleteOptions method."
Under CVSS v3, the vulns were scored as 9.8, a critical score, though it is important to note that CVSS scores are generally a guide to the worst-case-scenario impact of a vuln if it is misused.
The Register has asked Foxit for comment.
Use-after-free vulns are where an application re-reads memory that has been reallocated by the host system to something else; a suitably prepared malicious person can insert code into the right memory area which could, in theory, be read by the application and executed.
Last year Foxit suffered [3]a data security problem that saw "third parties" gain access to its users' My Account area data . ®
Get our [4]Tech Resources
[1] https://www.foxitsoftware.com/support/security-bulletins.html
[2] https://cwe.mitre.org/data/definitions/416.html
[3] https://www.theregister.com/2019/08/30/foxit_data_breach_passwords_stolen/
[4] https://whitepapers.theregister.com/
Given the number of PDF forms that are directly or indirectly fill-able. I have simply used Print to PDF for my needs.
>I have simply used Print to PDF for my needs.
Much depends on where you "print to PDF", eg. print to PDF using the Chrome option generates a different file to if you print using the Windows print service and use say the FoxIT PDF print driver to print to PDF.
There are times, for example when printing webpages that it is useful to use a Print-to-PDF function that retains the text and so you can subsequently cut-and-paste extracts.
The reason to run Foxit is long gone
I used to run Foxit as a simple reader for local PDF files, but it kept growing into a connected PDF browser, so much that I'd avoid updates to keep it small and simple (and not connected). Now that I use Acrobat DC for commenting PDF files, I'm almost perfectly happy with it, let alone for some UI glitches, and didn't even bother installing Foxit when switching to a new laptop.
"The software suite is widely used for manipulating PDFs, particularly by people whom, for whatever reason, eschew Adobe's products and pricing model."
Quite. Ignoring the [1]unfortnate grammar flub , I really won't go near Acrobat these days due to epic bloat. I'll often let Firefox show me PDFs, but otherwise I use [2]PDF-XChange Viewer * (because it's mildly less PLEASE PAY FOR ME than Foxit).
* Edit: Just seen that "PDF-XChange Viewer has been discontinued and replaced by PDF-XChange Editor - which is now available and includes all the features of the Viewer and much, much more..." Well, shit. So much for no bloat.
[1] https://www.youtube-nocookie.com/embed/1Eoyz_XxgoE
[2] https://www.tracker-software.com/product/pdf-xchange-viewer