Foxit PDF Reader

It has not been a good week for PDF programs. We had an Adobe Acrobat & Reader update released yesterday that fixed 86 vulnerabilities, including numerous critical ones. Not to be beaten, an update for Foxit PDF Reader and Foxit PhantomPDF was released last Friday that fixes a whopping 116 vulnerabilities, with 18 of them being discovered by the Cisco Talos group.

All of the 18 vulnerabilities found by Cisco Talos, as well as many others fixed by this update, are labeled as critical because they could lead to code execution. This would allow attackers to create specially crafted web pages or PDFs that could exploit these vulnerabilities to execute commands or install malware on vulnerable computers.

Of the 18 vulnerabilities disclosed by Cisco, 12 of them could be exploited simply by visiting a web site when the Foxit PDF browser plugin is enabled.

Foxit suggests that all users of Foxit PDF Reader and Foxit PhantomPDF upgrade to version 9.3 to resolve these vulnerabilities. Foxit PDF Reader 9.3 can be downloaded here and Foxit PhantomPDF can be downloaded here. It is strongly suggested that all users install this update.

The full list of patched vulnerabilities is below and more information about who discovered the vulnerabilities can be found in Foxit's security bulletin.

Fixed vulnerabilities in version 9.3:

CVE-2018-3940, CVE-2018-3941, CVE-2018-3942, CVE-2018-3943, CVE-2018-3944, CVE-2018-3945, CVE-2018-3946, CVE-2018-3957, CVE-2018-3958, CVE-2018-3959, CVE-2018-3960, CVE-2018-3961, CVE-2018-3962, CVE-2018-3964, CVE-2018-3965, CVE-2018-3966, CVE-2018-3967, CVE-2018-3992, CVE-2018-3993, CVE-2018-3994, CVE-2018-3995, CVE-2018-3996, CVE-2018-3997, CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16295, CVE-2018-16296, CVE-2018-16297, CVE-2018-17781, ZDI-CAN-6333, ZDI-CAN-6334, ZDI-CAN-6335, ZDI-CAN-6336, ZDI-CAN-6352, ZDI-CAN-6353, ZDI-CAN-6354, ZDI-CAN-6355, ZDI-CAN-6434, ZDI-CAN-6435, ZDI-CAN-6435, ZDI-CAN-6438, ZDI-CAN-6439, ZDI-CAN-6455, ZDI-CAN-6458, ZDI-CAN-6470, ZDI-CAN-6471, ZDI-CAN-6472, ZDI-CAN-6473, ZDI-CAN-6474, ZDI-CAN-6475, ZDI-CAN-6477, ZDI-CAN-6478, ZDI-CAN-6479, ZDI-CAN-6480, ZDI-CAN-6481, ZDI-CAN-6482, ZDI-CAN-6483, ZDI-CAN-6484, ZDI-CAN-6485, ZDI-CAN-6486, ZDI-CAN-6487, ZDI-CAN-6498, ZDI-CAN-6499, ZDI-CAN-6500, ZDI-CAN-6501, ZDI-CAN-6502, ZDI-CAN-6503, ZDI-CAN-6504, ZDI-CAN-6505, ZDI-CAN-6506, ZDI-CAN-6507, ZDI-CAN-6509, ZDI-CAN-6511, ZDI-CAN-6512, ZDI-CAN-6513, ZDI-CAN-6514, ZDI-CAN-6517, ZDI-CAN-6518, ZDI-CAN-6519, ZDI-CAN-6520, ZDI-CAN-6521, ZDI-CAN-6522, ZDI-CAN-6523, ZDI-CAN-6524, ZDI-CAN-6614, ZDI-CAN-6616, ZDI-CAN-6617, ZDI-CAN-6700, ZDI-CAN-6817, ZDI-CAN-6819, ZDI-CAN-6820, ZDI-CAN-6844, ZDI-CAN-6845, ZDI-CAN-6848, ZDI-CAN-6849, ZDI-CAN-6850, ZDI-CAN-6851, ZDI-CAN-6890, ZDI-CAN-6915, ZDI-CAN-7067, ZDI-CAN-7068, ZDI-CAN-7069, ZDI-CAN-7070, ZDI-CAN-7073, ZDI-CAN-7103, ZDI-CAN-7138, ZDI-CAN-7141, ZDI-CAN-7145, ZDI-CAN-7157, ZDI-CAN-7163, ZDI-CAN-7169, ZDI-CAN-7170, ZDI-CAN-7252, ZDI-CAN-7253, ZDI-CAN-7254, ZDI-CAN-7255

Related Articles:

Microsoft October 2018 Patch Tuesday Fixes 12 Critical Vulnerabilities

Adobe Releases October 2018 Security Updates. None for Flash Player!

Mozilla Patches Critical Vulnerability in Thunderbird 60.2.1

No Patch Available Yet for New Major Vulnerability in Ghostscript Interpreter

Libssh CVE-2018-10933 Scanners & Exploits Released - Apply Updates Now