Foxit Reader is prone to a buffer-overflow vulnerability that occurs because it fails to perform adequate boundary checks on user-supplied data via a crafted .PDF document. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

This module exploits a buffer overflow vulnerability in Foxit Reader. If an Open/Execute a file action is defined in the PDF file with an overly long file name argument, when the trigger condition is satisfied it will cause a stack-based buffer overflow, because the application tries to copy the file name argument to a fixed-size buffer in the stack without properly checking that the buffer is large enough to hold the file name string. This module runs a malicious web site on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site.

The vulnerability is caused due to a boundary error when parsing format strings containing a floating point specifier in the "util.printf()" JavaScript function. This module runs a malicious web site on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site.

This module exploits an unsafe Javascript API implemented in Foxit PDF Reader version 4.2. The createDataObject() Javascript API function allows for writing arbitrary files to the file system. This issue was fixed in version 4.3.1.0218.

Foxit Reader is prone to a vulnerability that may allow the loading and execution of any library file named imgseg.dll, if this dll is located in a determined subfolder where a .PDF file is. The attacker must entice a victim into opening a specially crafted .PDF file. This file and the associated binary may be delivered to a user through remote WebDAV shares. An attacker may exploit this issue to execute arbitrary code.

This module exploits a buffer overflow in the Foxit Reader Plugin npFoxitReaderPlugin that is exposed when loading PDF files from remote hosts with overly long query strings within the URL. This module runs a web server waiting for vulnerable clients (Firefox) to connect to it. When the client connects, it will try to install an agent by exploiting this vulnerability.

Foxit PDF Reader is prone to a vulnerability that may allow the execution of any library file named dwmapi.dll, if this dll is located in the same folder than a .PDF file. The attacker must entice a victim into opening a specially crafted .HEX file. This file and the associated binary may be delivered to a user through remote WebDAV shares. An attacker may exploit this issue to execute arbitrary code.

A vulnerability has been identified in Foxit Reader, which could be exploited by attackers to compromise a vulnerable system. This issue is caused by a stack-based buffer overflow error when processing Compact Font Format (CFF) data within a PDF document, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted PDF document. This vulnerability is the same that is currently being exploited to jailbreak the iPhone 4 OS.

Foxit Phantom PDF Suite is prone to a buffer-overflow vulnerability that occurs because it fails to perform adequate boundary checks on user-supplied data via a crafted .PDF document. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

This exploit takes advantage of a vulnerability that allows attackers to cause FlashGet to execute arbitrary code via a malformed FTP PWD response.