← Back

CVE-2020-35931

nvd nist
Published: Dec 31, 2020Modified: Nov 21, 2024

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

An issue was discovered in Foxit Reader before 10.1.1 (and before 4.1.1 on macOS) and PhantomPDF before 9.7.5 and 10.x before 10.1.1 (and before 4.1.1 on macOS). An attacker can spoof a certified PDF document via an Evil Annotation Attack because the products fail to consider a null value for a Subtype entry of the Annotation dictionary, in an incremental update.

Affected (5)

Foxitsoftware
2 products
Foxit Reader
Phantompdf
Configuration A
3 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Foxit Reader
Before 10.1.1
Foxitsoftware
Phantompdf
Before 9.7.5
Phantompdf
From 10.0.0 to 10.1.1
Running on/withPlatform Versions
Microsoft
Windows
All versions
Configuration B
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Foxit Reader
Before 4.1.1
Phantompdf
Before 4.1.1
Running on/withPlatform Versions
Apple
Macos
All versions

Related CWEs

CWE-754
Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

References (2)

Source: cve@mitre.org
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory

Timeline

No history available yet.