NVD Vulnerability Detail

CVE-2018-19348

Summary	The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x000000000012dff5" issue.
Publication Date	Nov. 18, 2018, 6:29 a.m.
Registration Date	March 1, 2021, 7:13 p.m.
Last Update	Nov. 21, 2024, 12:57 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:foxitsoftware:foxit_reader:9.3.0.10826:::::::*
cpe:2.3:a:foxitsoftware:u3d:9.3.0.10809:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	https://www.foxitsoftware.com/support/security-bulletins.php	MISC	Vendor Advisory
2	https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/08/2018/11/2018-11-08/index.html		Broken Link Third Party Advisory
3	https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/08/2018/11/2018-11-08/index.html		Broken Link Third Party Advisory
4	https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html		Broken Link Third Party Advisory
5	https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/10/2018/11/2018-11-10/index.html		Broken Link Third Party Advisory
6	https://yan-1-20.github.io/2018/11/08/2018/11/2018-11-08/		Broken Link Third Party Advisory
7	https://yan-1-20.github.io/2018/11/08/2018/11/2018-11-08/		Broken Link Third Party Advisory
8	https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/		Broken Link Third Party Advisory
9	https://yan-1-20.github.io/2018/11/10/2018/11/2018-11-10/		Broken Link Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html

JVN Vulnerability Information

u3d plugin および Foxit Reader における境界外読み取りに関する脆弱性

Title	u3d plugin および Foxit Reader における境界外読み取りに関する脆弱性
Summary	u3d plugin (別名 plugins U3DBrowser.fpi) および Foxit Reader には、境界外読み取りに関する脆弱性が存在します。
Possible impacts	情報を取得される、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 23, 2018, midnight
Registration Date	Jan. 30, 2019, 6:08 p.m.
Last Update	Jan. 30, 2019, 6:08 p.m.

Affected System

Foxit Software Inc

3D Plugin Beta 9.3.0.10809

Foxit Reader 9.3.0.10826

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-19348	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19348
2	CVE-2018-19348	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19348
National Vulnerability Database (NVD)
3	CVE-2018-19348	https://nvd.nist.gov/vuln/detail/CVE-2018-19348
4	CVE-2018-19348	https://nvd.nist.gov/vuln/detail/CVE-2018-19348

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-125	https://cwe.mitre.org/data/definitions/125.html
2	CWE-125	https://cwe.mitre.org/data/definitions/125.html

ベンダー情報

No	Name	URL
Security bulletins
1	Security update available in 3D Plugin Beta 9.3.0.10830	https://www.foxitsoftware.com/support/security-bulletins.php
2	Security update available in 3D Plugin Beta 9.3.0.10830	https://www.foxitsoftware.com/support/security-bulletins.php

Change Log

No	Changed Details	Date of change
1	[2019年01月30日] 掲載	Jan. 30, 2019, 6:08 p.m.
1	[2019年01月30日] 掲載	Jan. 30, 2019, 6:08 p.m.