CVE-2018-17781

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Foxit PhantomPDF and Reader before 9.3 allow remote attackers to trigger Uninitialized Object Information Disclosure because creation of ArrayBuffer and DataView objects is mishandled.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securitytracker.com/id/1041769Third Party Advisory, VDB Entry
https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory
http://www.securitytracker.com/id/1041769Third Party Advisory, VDB Entry
https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory

Timeline

Published: Sep 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-177825.4A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remot CVE-2018-177835.4A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows rem CVE-2018-177846.1Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacke CVE-2018-177857.5In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as de CVE-2018-177869.8On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.cgi do not require authenticat CVE-2018-177879.8On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data, because thi CVE-2018-177896.5Prospecta Master Data Online (MDO) allows CSRF.CVE-2018-17797.5IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause a denial of service due to not setting limits on JS CVE-2018-177905.4Prospecta Master Data Online (MDO) 2.0 has Stored XSS.CVE-2018-177917.5Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side valid CVE-2018-177928.8MDaemon Webmail (formerly WorldClient) has CSRF.CVE-2018-177946.5An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_st