CVE-2017-6883

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The ConvertToPDF plugin in Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF image. The vulnerability could lead to information disclosure; an attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.

Metrics

CVSS 3.0 4.7/10CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/96870
http://www.zerodayinitiative.com/advisories/ZDI-17-133/Third Party Advisory, VDB Entry
https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/96870
http://www.zerodayinitiative.com/advisories/ZDI-17-133/Third Party Advisory, VDB Entry
https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory

Timeline

Published: Mar 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-68848.8A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is locate CVE-2017-68859.8An error when handling certain external commands and services related to the FlexNet Inventory Agent and FlexNet Beacon of the Flexera Softw CVE-2017-68869.8An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt mem CVE-2017-68877.8A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cau CVE-2017-68885.5An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a m CVE-2017-68899.8An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploi CVE-2017-68909.8A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 be CVE-2017-68918.8Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-bas CVE-2017-68928.8In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory CVE-2017-68947.8A vulnerability exists in FlexNet Manager Suite releases 2015 R2 SP3 and earlier (including FlexNet Manager Platform 9.2 and earlier) that a CVE-2017-68959.8USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml.CVE-2017-68968.8Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to a