CVE-2018-18933 - Vulnerability Details - OpenCVE

The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader!safe_vsnprintf+0x00000000002c4330" issue.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Foxitsoftware	Foxit Reader U3d

Configuration 1 [-]

OR	cpe:2.3:a:foxitsoftware:foxit_reader:9.3.0.10826:::::::*
	cpe:2.3:a:foxitsoftware:u3d:9.3.0.10809:::::::*

No data.

References

Link	Providers
https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/02/2018/11/2018-11-02/index.html
https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html
https://www.foxitsoftware.com/support/security-bulletins.php
https://yan-1-20.github.io/2018/11/02/2018/11/2018-11-02/
https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-11-05T08:00:00

Updated: 2024-08-05T11:23:08.582Z

Reserved: 2018-11-04T00:00:00

Link: CVE-2018-18933

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-11-05T09:29:00.227

Modified: 2024-11-21T03:56:54.003

Link: CVE-2018-18933

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-11-04T00:00:00", "descriptions": [{"lang": "en", "value": "The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a \"Read Access Violation near NULL starting at FoxitReader!safe_vsnprintf+0x00000000002c4330\" issue."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-11-17T22:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://yan-1-20.github.io/2018/11/02/2018/11/2018-11-02/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/02/2018/11/2018-11-02/index.html"}, {"tags": ["x_refsource_MISC"], "url": "https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-18933", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a \"Read Access Violation near NULL starting at FoxitReader!safe_vsnprintf+0x00000000002c4330\" issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://yan-1-20.github.io/2018/11/02/2018/11/2018-11-02/", "refsource": "MISC", "url": "https://yan-1-20.github.io/2018/11/02/2018/11/2018-11-02/"}, {"name": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html", "refsource": "MISC", "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html"}, {"name": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/02/2018/11/2018-11-02/index.html", "refsource": "MISC", "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/02/2018/11/2018-11-02/index.html"}, {"name": "https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/", "refsource": "MISC", "url": "https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T11:23:08.582Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://yan-1-20.github.io/2018/11/02/2018/11/2018-11-02/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/02/2018/11/2018-11-02/index.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-18933", "datePublished": "2018-11-05T08:00:00", "dateReserved": "2018-11-04T00:00:00", "dateUpdated": "2024-08-05T11:23:08.582Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:9.3.0.10826:*:*:*:*:*:*:*", "matchCriteriaId": "B5DFC3EB-168B-43C9-8C83-6FED38A2D3B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:foxitsoftware:u3d:9.3.0.10809:*:*:*:*:*:*:*", "matchCriteriaId": "F5A3BE32-0074-4C15-80DA-4C90E623769D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The u3d plugin 9.3.0.10809 (aka plugins\\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a \"Read Access Violation near NULL starting at FoxitReader!safe_vsnprintf+0x00000000002c4330\" issue."}, {"lang": "es", "value": "El plugin u3d 9.3.0.10809 (tambi\u00e9n conocido como plugins\\U3DBrowser.fpi) en FoxitReader.exe en Foxit Reader 9.3.0.10826 permite que los atacantes remotos provoquen una denegaci\u00f3n de servicio (lectura fuera de l\u00edmites) u obtengan informaci\u00f3n sensible mediante una muestra U3D debido a un problema \"Read Access Violation near NULL starting at FoxitReader!safe_vsnprintf+0x00000000002c4330\"."}], "id": "CVE-2018-18933", "lastModified": "2024-11-21T03:56:54.003", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-11-05T09:29:00.227", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/02/2018/11/2018-11-02/index.html"}, {"source": "cve@mitre.org", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html"}, {"source": "cve@mitre.org", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://yan-1-20.github.io/2018/11/02/2018/11/2018-11-02/"}, {"source": "cve@mitre.org", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/"}, {"source": "nvd@nist.gov", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.foxitsoftware.com/support/security-bulletins.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/02/2018/11/2018-11-02/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://yan-1-20.github.io/2018/11/02/2018/11/2018-11-02/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}