CVE-2015-8843

The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2, when an update to the Cloud plugin is available, allows local users to gain privileges by writing crafted data to a shared memory region, which triggers memory corruption.

CVSS v3 7.4 HIGH
CVSS v2.0 6.9 MEDIUM

7.4^/10

CVSS v3 : HIGH

Vector : AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.4 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.zerodayinitiative.com/advisories/ZDI-15-640
https://www.foxitsoftware.com/support/security-bulletins.php#FRD-35	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:foxitsoftware:foxit_reader:6.1:::::::*
	cpe:2.3:a:foxitsoftware:foxit_reader:6.1.2:::::::*
	cpe:2.3:a:foxitsoftware:foxit_reader:6.1.4:::::::*
	cpe:2.3:a:foxitsoftware:foxit_reader:6.2:::::::*
	cpe:2.3:a:foxitsoftware:foxit_reader:6.2.1:::::::*
	cpe:2.3:a:foxitsoftware:foxit_reader:7.0:::::::*
	cpe:2.3:a:foxitsoftware:foxit_reader:7.0.1:::::::*
	cpe:2.3:a:foxitsoftware:foxit_reader:7.0.6:::::::*
	cpe:2.3:a:foxitsoftware:foxit_reader:7.1.5:::::::*
	cpe:2.3:a:foxitsoftware:foxit_reader:7.2:::::::*

History

No history.

Information

Published : 2016-04-13 15:59

Updated : 2023-12-10 11:46

NVD link : CVE-2015-8843

Mitre link : CVE-2015-8843

CVE.ORG link : CVE-2015-8843

JSON object : View

Products Affected

foxitsoftware

foxit_reader

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2015-8843", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.4}]}, "published": "2016-04-13T15:59:10.727", "references": [{"url": "http://www.zerodayinitiative.com/advisories/ZDI-15-640", "source": "cve@mitre.org"}, {"url": "https://www.foxitsoftware.com/support/security-bulletins.php#FRD-35", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2, when an update to the Cloud plugin is available, allows local users to gain privileges by writing crafted data to a shared memory region, which triggers memory corruption."}, {"lang": "es", "value": "El Foxit Cloud Update Service (FoxitCloudUpdateService) en Foxit Reader 6.1 hasta la versi\u00f3n 6.2.x y 7.x en versiones anteriores a 7.2.2, cuando una actualizaci\u00f3n para el plugin Cloud est\u00e1 disponible, permite a usuarios locales obtener privilegios escribiendo datos manipulados a una regi\u00f3n de memoria compartida, lo que desencadena una corrupci\u00f3n de memoria."}], "lastModified": "2016-04-19T03:51:45.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBCF7F04-61D5-4710-967E-88ED852F39D6"}, {"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:6.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0CB6692-919F-4C38-B7D4-FDAA64ED2E9B"}, {"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:6.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21F07967-599D-4A37-9940-42208E831C47"}, {"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5569F618-ACE5-45D5-AE13-4A77AAA3F334"}, {"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:6.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99BEB81B-C9F5-4CCC-B4C9-4485901049D8"}, {"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CC020B5-23C0-457C-B826-FF0468AFFD63"}, {"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "605010F1-65B7-432D-94ED-C74DA443163A"}, {"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:7.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1379798D-CADA-42DA-9FE7-469808CF55F3"}, {"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:7.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B823EB7C-16F1-43B7-8AA6-72D3AFD27FEB"}, {"criteria": "cpe:2.3:a:foxitsoftware:foxit_reader:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B8FA0F1-98C5-4E39-92EE-4143948081D7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}