CVE-2019-5031

Name
CVE-2019-5031
Description
An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A specially crafted PDF document can trigger an out-of-memory condition which isn't handled properly, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Exploit https://talosintelligence.com/vulnerability_reports/TALOS-2019-0793

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:foxitsoftware:phantompdf:*:*:*:*:*:*:*:* phantompdf >= None <= 9.4.1.16828
cpe:2.3:a:foxitsoftware:reader:*:*:*:*:*:*:*:* reader >= None <= 9.4.1.16828

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
reader 3.19-community 0.4.4-r4 Adam Thiede <me@adamthiede.com> possibly vulnerable
reader 3.20-community 0.4.5-r0 Adam Thiede <me@adamthiede.com> possibly vulnerable
reader edge-community 0.4.5-r0 Adam Thiede <me@adamthiede.com> possibly vulnerable