GCVE - cpe:2.3:a:foxitsoftware:foxit_reader:2.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:foxitsoftware:foxit_reader:2.3:*:*:*:*:*:*:*

part: a version: 2.3 update: *

Vendor	Foxitsoftware (`432505a3-624b-5d0c-b6e3-841531927527`)
Product	Foxit Reader (`058768da-164a-5e12-a06d-4983e7214eaf`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-4337`	vulnerable	2026-06-03 14:32:18.421645	Details available Foxit Reader before 5.3 on Windows XP and Windows 7 allows remote attackers to execute arbitrary code via a PDF document with a crafted attachment that triggers calculation of a negative number during processing of cross references. Published: 2012-08-23T15:00:00.000Z Updated: 2024-09-16T19:56:39.365Z Open on db.gcve.eu Reference links http://securitytracker.com/id?1027424 http://www.osvdb.org/84808 http://technet.microsoft.com/security/msvr/msvr12-013 http://www.foxitsoftware.com/Secure_PDF_Reader/security_bulletins.php http://secunia.com/advisories/50359	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3691`	vulnerable	2026-06-03 14:31:21.620746	Details available Untrusted search path vulnerability in Foxit Reader before 5.0.2.0718 allows local users to gain privileges via a Trojan horse dwmapi.dll, dwrite.dll, or msdrm.dll in the current working directory. Published: 2011-09-27T19:00:00.000Z Updated: 2024-09-16T16:43:37.256Z Open on db.gcve.eu Reference links http://www.solutionary.com/index/SERT/Vuln-Disclosures/Foxit-Reader.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1908`	vulnerable	2026-06-03 14:31:04.404892	Details available Integer overflow in the Type 1 font decoder in the FreeType engine in Foxit Reader before 4.0.0.0619 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font in a PDF document. Published: 2011-06-24T20:00:00.000Z Updated: 2024-08-06T22:46:00.196Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/48359 http://www.microsoft.com/technet/security/advisory/msvr11-005.mspx https://exchange.xforce.ibmcloud.com/vulnerabilities/68145 http://www.foxitsoftware.com/products/reader/security_bulletins.php#freetype	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0332`	vulnerable	2026-06-03 14:30:48.447217	Details available Integer overflow in Foxit Reader before 4.3.1.0218 and Foxit Phantom before 2.3.3.1112 allows remote attackers to execute arbitrary code via crafted ICC chunks in a PDF file, which triggers a heap-based buffer overflow. Published: 2011-02-25T18:00:00.000Z Updated: 2024-08-06T21:51:07.762Z Open on db.gcve.eu Reference links http://secunia.com/advisories/43440 http://www.vupen.com/english/advisories/2011/0508 http://secunia.com/secunia_research/2011-14/ http://secunia.com/advisories/43329 http://www.foxitsoftware.com/pdf/reader/security_bulletins.php#memory	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1239`	vulnerable	2026-06-03 14:30:13.689082	Details available Foxit Reader before 3.2.1.0401 allows remote attackers to (1) execute arbitrary local programs via a certain "/Type /Action /S /Launch" sequence, and (2) execute arbitrary programs embedded in a PDF document via an unspecified "/Launch /Action" sequence, a related issue to CVE-2009-0836. Published: 2010-04-05T15:15:00.000Z Updated: 2024-09-16T17:22:42.306Z Open on db.gcve.eu Reference links http://www.f-secure.com/weblog/archives/00001923.html http://www.kb.cert.org/vuls/id/570177 http://blog.didierstevens.com/2010/03/29/escape-from-pdf/ http://blog.didierstevens.com/2010/03/31/escape-from-foxit-reader/ http://www.foxitsoftware.com/pdf/reader/security.htm#0401	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0191`	vulnerable	2026-06-03 14:29:22.929054	Details available Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 3.0.2009.1301, does not properly handle a JBIG2 symbol dictionary segment with zero new symbols, which allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a dereference of an uninitialized memory location. Published: 2009-03-10T20:00:00.000Z Updated: 2024-08-07T04:24:18.254Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/49135 http://www.securitytracker.com/id?1021822 http://secunia.com/advisories/34036 http://www.vupen.com/english/advisories/2009/0634 http://www.securityfocus.com/archive/1/501590/100/0/threaded	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.