CVE-2020-11493

In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of direct transformation from PDF Object to Stream without concern for a crafted XObject.

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CVSS v2.0 NVD

5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:P

EPSS

0.93% chance of exploitation in the next 30 days, 60th percentile

Published

2020-09-04

Updated

2024-08-04

Proof-of-concept exploits (1)

• fengjixuchui/CVE-2020-114931★ · 2020-06-01

Security advisories

• https://www.foxitsoftware.com/support/security-bulletins.php

References

• CVE Record
• NVD entry

Related

• CVE-2003-0358
• CVE-2009-4049
• CVE-2016-0095
• CVE-2019-18845
• CVE-2019-8038
• CVE-2019-8039