CVE-2009-0836 Other in n/a
Remote attackers can execute arbitrary programs via crafted PDF files because Foxit Reader fails to require user confirmation for dangerous actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2009-0836?
CVE-2009-0836 is a critical vulnerability in Foxitsoftware Reader, published on 10 Mar 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before performing dangerous actions defined in a PDF file, which allows remote attackers to execute arbitrary programs and have unspecified other impact via a crafted file, as demonstrated by the "Open/Execute a file" action.
Weakness: CWE-119
Which versions are affected by CVE-2009-0836?
It affects 1 product.
Products include Foxitsoftware Reader.
How do I fix CVE-2009-0836?
No fix has been published for CVE-2009-0836 yet. Limit exposure of the affected software until one is available.
Is CVE-2009-0836 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-0836 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Foxitsoftware Reader
Sources
Also known as GHSA-xp5q-j3fq-3qw3.