Security bulletins

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Read vulnerability and crash when handling certain Doc, Graphic, Signature, or Bookmark objects, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the use of null pointer or object that has been deleted or freed without proper validation. (CVE-2023-51554, CVE-2023-51553, CVE-2023-51555, CVE-2023-51559, CVE-2023-51551, CVE-2023-42089, CVE-2023-51550, CVE-2023-51562)

• XP from ZGCLab
• Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to launch a Denial of Service attack. This occurs as the application fails to properly validate the empty values returned by certain interfaces when handling the text annotations in certain PDFs.

• XP from ZGCLab

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Read vulnerability and crash when handling certain Doc, Graphic, Signature, or Bookmark objects, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the use of null pointer or object that has been deleted or freed without proper validation. (CVE-2023-51554, CVE-2023-51553, CVE-2023-51555, CVE-2023-51559, CVE-2023-51551, CVE-2023-42089, CVE-2023-51550, CVE-2023-51562)

• XP from ZGCLab
• Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to launch a Denial of Service attack. This occurs as the application fails to properly validate the empty values returned by certain interfaces when handling the text annotations in certain PDFs.

• XP from ZGCLab

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-After-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash when handling certain Doc, Graphic, Signature, Bookmark, or 3D annotation objects, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the use of null pointer, wild pointer, or object that has been deleted or freed without proper validation. (CVE-2023-51549, CVE-2023-51550, CVE-2023-51552, CVE-2023-51554, CVE-2023-51553, CVE-2023-32616, CVE-2023-41257, CVE-2023-38573, CVE-2023-51555, CVE-2023-51556, CVE-2023-51557, CVE-2023-51558, CVE-2023-51559, CVE-2023-51551, CVE-2023-51562)

• XP from ZGCLab
• Anonymous working with Trend Micro Zero Day Initiative
• Kamlapati Choubey of Cisco Talos
• Aleksandar Nikolic and KPC of Cisco Talos

Addressed potential issues where the application could be exposed to Arbitrary File Creation vulnerability, which could be exploited by attackers to execute arbitrary code. This occurs as the application directly opens the executable files due to the failure to properly identify the file type that is disallowed to be opened when handling the exportDataObject method of the Doc object. (CVE-2023-40194, CVE-2023-35985)

• Kamlapati Choubey of Cisco Talos

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Write vulnerability and crash, which could be exploited by attackers to execute arbitrary code. This occurs due to the GDI memory overflow as the application fails to properly handle the user inputs.

• Suyue Guo, Wei You from Renmin University of China

Addressed a potential issue where the application could be exposed to Arbitrary File Execution vulnerability when opening certain PDF files that include the OpenAction method using the relative path with path spoofing techniques, which could be exploited by attackers to deceive users to execute commands to spread malicious code. The application has optimized the Launch File process, including getting the absolute path, restricting the execution of files whose file path exceeds 260 characters, and enlarging the window to display the full path (within 260 characters) of the file to be executed.

• Anonymous researcher

Addressed a potential issue where the application could be exposed to Type Confusion vulnerability and crash when handling certain Annotation objects, which could be exploited by attackers to execute remote code. This occurs due to the access of illegal memory as the application casts the pointers of different types without inheritance relation and uses them without proper validation. (CVE-2023-51560)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read vulnerability, which could be exploited by attackers to disclose information. This occurs as the application fails to properly initialize the allocated pointer when parsing certain PDF files. (CVE-2023-51561)

• Mat Powell of Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Read vulnerability and crash when handling certain Doc, Graphic, Signature, or Bookmark objects, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the use of null pointer or object that has been deleted or freed without proper validation. (CVE-2023-51554, CVE-2023-51553, CVE-2023-51555, CVE-2023-51559, CVE-2023-51551)

• XP from ZGCLab
• Anonymous working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-After-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash when handling certain Doc, Graphic, Signature, Bookmark, or 3D annotation objects, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the use of null pointer, wild pointer, or object that has been deleted or freed without proper validation. (CVE-2023-51549, CVE-2023-51550, CVE-2023-51552, CVE-2023-51554, CVE-2023-51553, CVE-2023-32616, CVE-2023-41257, CVE-2023-38573, CVE-2023-51555, CVE-2023-51556, CVE-2023-51557, CVE-2023-51558, CVE-2023-51559, CVE-2023-51551, CVE-2023-51562)

• XP from ZGCLab
• Anonymous working with Trend Micro Zero Day Initiative
• Kamlapati Choubey of Cisco Talos
• Aleksandar Nikolic and KPC of Cisco Talos

Addressed potential issues where the application could be exposed to Arbitrary File Creation vulnerability, which could be exploited by attackers to execute arbitrary code. This occurs as the application directly opens the executable files due to the failure to properly identify the file type that is disallowed to be opened when handling the exportDataObject method of the Doc object. (CVE-2023-40194, CVE-2023-35985)

• Kamlapati Choubey of Cisco Talos

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Write vulnerability and crash, which could be exploited by attackers to execute arbitrary code. This occurs due to the GDI memory overflow as the application fails to properly handle the user inputs.

• Suyue Guo, Wei You from Renmin University of China

Addressed a potential issue where the application could be exposed to Arbitrary File Execution vulnerability when opening certain PDF files that include the OpenAction method using the relative path with path spoofing techniques, which could be exploited by attackers to deceive users to execute commands to spread malicious code. The application has optimized the Launch File process, including getting the absolute path, restricting the execution of files whose file path exceeds 260 characters, and enlarging the window to display the full path (within 260 characters) of the file to be executed.

• Anonymous researcher

Addressed a potential issue where the application could be exposed to Type Confusion vulnerability and crash when handling certain Annotation objects, which could be exploited by attackers to execute remote code. This occurs due to the access of illegal memory as the application casts the pointers of different types without inheritance relation and uses them without proper validation. (CVE-2023-51560)

• Anonymous working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Read vulnerability and crash when handling certain Doc, Graphic, Signature, or Bookmark objects, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the use of null pointer or object that has been deleted or freed without proper validation. (CVE-2023-51554, CVE-2023-51553, CVE-2023-51555, CVE-2023-51559, CVE-2023-51551)

• XP from ZGCLab
• Anonymous working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts. (CVE-2023-28744, CVE-2023-38111, CVE-2023-38107, CVE-2023-38109, CVE-2023-38113, CVE-2023-38114, CVE-2023-38112, CVE-2023-38110, CVE-2023-38115, CVE-2023-38117, CVE-2023-27379, CVE-2023-33866, CVE-2023-32664, CVE-2023-33876)

• Aleksandar Nikolic of Cisco Talos
• Anonymous working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative
• Aleksandar Nikolic and Kamlapati Choubey of Cisco Talos

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information. This is caused by the access violation as the application reads the bytes beyond the range of the stream or uses the color components (defined in the color space dictionary) that are inconsistent with the actual ones for the image object when converting the color space of an image. (CVE-2023-38105, CVE-2023-38106, CVE-2023-38108, CVE-2023-38116)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Arbitrary File Read vulnerability, which could be exploited by attackers to disclose files in the target system. This occurs as the application fails to properly validate the type of attachment when calling the methods (with file attachments specified) to create annotations.

• @j00sean

Addressed potential issues where the application could be exposed to Arbitrary File Deletion vulnerability, which could be exploited by attackers to delete the private files in the current user context. This occurs as the application fails to validate the file type and deletes the target file improperly without checking its existence in the user system when calling certain JavaScripts to export PDFs.

• @j00sean

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read Remote Code Execution vulnerability and crash when handling certain PDF files that include signatures. This occurs as the application verifies the signatures concurrently in a multi-threaded environment and overwrites the data multiple times. (CVE-2023-38119)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the access violation as the application fails to handle the abnormal parameters properly when rendering the annotation pop-up notes in certain PDF files. (CVE-2023-38118)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-After-Free vulnerability and crash when handling certain JavaScripts, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the inconsistency between the exported values and appearance values as the application fails to properly handle the radio button component that is missing the Appearance Dictionary, or due to the use of deleted objects without proper validation. (CVE-2023-42089, CVE-2023-42090, CVE-2023-42091, CVE-2023-42092, CVE-2023-42093, CVE-2023-42094, CVE-2023-42095, CVE-2023-42096, CVE-2023-42097, CVE-2023-42098)

• Anonymous working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to launch a Denial of Service attack. This occurs as the application fails to properly validate the indirectly obtained objects or empty values returned by certain interfaces when handling the bookmarks or text annotations in certain PDFs.

• XP from ZGCLab

Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability when handling certain JavaScripts. This occurs as the application fails to validate the cPath parameter in the saveAs method and is thus forced to write to the Startup folder with an .hta file that can execute arbitrary code after a restart. (CVE-2023-39542)

• Kamlapati Choubey of Cisco Talos

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-After-Free vulnerability and crash when handling certain JavaScripts, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the inconsistency between the exported values and appearance values as the application fails to properly handle the radio button component that is missing the Appearance Dictionary, or due to the use of deleted objects without proper validation. (CVE-2023-42089, CVE-2023-42090, CVE-2023-42091, CVE-2023-42092, CVE-2023-42093, CVE-2023-42094, CVE-2023-42095, CVE-2023-42096, CVE-2023-42097, CVE-2023-42098)

• Anonymous working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to launch a Denial of Service attack. This occurs as the application fails to properly validate the indirectly obtained objects or empty values returned by certain interfaces when handling the bookmarks or text annotations in certain PDFs.

• XP from ZGCLab

Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability when handling certain JavaScripts. This occurs as the application fails to validate the cPath parameter in the saveAs method and is thus forced to write to the Startup folder with an .hta file that can execute arbitrary code after a restart. (CVE-2023-39542)

• Kamlapati Choubey of Cisco Talos

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-after-Free or Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts. (CVE-2023-28744, CVE-2023-38111, CVE-2023-38107, CVE-2023-38109, CVE-2023-38113, CVE-2023-38112, CVE-2023-38110, CVE-2023-38117)

• Aleksandar Nikolic of Cisco Talos
• Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be terminated by force when data overflow was detected in XFA JavaScripts.

• Philip Kolvenbach of Fraunhofer Institute for Secure Information Technology (SIT)

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts. (CVE-2023-28744, CVE-2023-38111, CVE-2023-38107, CVE-2023-38109, CVE-2023-38113, CVE-2023-38114, CVE-2023-38112, CVE-2023-38110, CVE-2023-38115, CVE-2023-38117, CVE-2023-27379, CVE-2023-33866, CVE-2023-32664, CVE-2023-33876)

• Aleksandar Nikolic of Cisco Talos
• Anonymous working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative
• Aleksandar Nikolic and Kamlapati Choubey of Cisco Talos

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information. This is caused by the access violation as the application reads the bytes beyond the range of the stream or uses the color components (defined in the color space dictionary) that are inconsistent with the actual ones for the image object when converting the color space of an image. (CVE-2023-38105, CVE-2023-38106, CVE-2023-38108, CVE-2023-38116)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Arbitrary File Read vulnerability, which could be exploited by attackers to disclose files in the target system. This occurs as the application fails to properly validate the type of attachment when calling the methods (with file attachments specified) to create annotations.

• @j00sean

Addressed potential issues where the application could be exposed to Arbitrary File Deletion vulnerability, which could be exploited by attackers to delete the private files in the current user context. This occurs as the application fails to validate the file type and deletes the target file improperly without checking its existence in the user system when calling certain JavaScripts to export PDFs.

• @j00sean

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read Remote Code Execution vulnerability and crash when handling certain PDF files that include signatures. This occurs as the application verifies the signatures concurrently in a multi-threaded environment and overwrites the data multiple times. (CVE-2023-38119)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the access violation as the application fails to handle the abnormal parameters properly when rendering the annotation pop-up notes in certain PDF files. (CVE-2023-38118)

• Anonymous working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability when handling certain JavaScripts. This occurs as the application fails to validate the cPath parameter in the exportXFAData method and is thus forced to write to the Startup folder with an .hta file that can execute arbitrary code after a restart. (CVE-2023-27363)

• Andrea Micalizzi aka rgod working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Remote Code Execution vulnerability and crash when parsing certain XLS or DOC files. This occurs as the application opens the XLS or DOC file with the default permissions and allows for the execution of macros without proper restrictions or consents from users. (CVE-2023-27364, CVE-2023-27365)

• kimiya working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference or Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the access of null pointer or freed memory without proper validation when handling certain JavaScripts. (CVE-2023-27366)

• Suyue Guo, Wei You from Renmin University of China
• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Local Privilege Escalation vulnerability. This occurs as the original executable file of the registered service with system-level permissions can be hijacked by users with normal permissions when the application is installed in a non-standard directory.

• Will Dormann of Vul Labs

Addressed a potential issue where the application could be terminated by force when data overflow was detected in XFA JavaScripts.

• Philip Kolvenbach of Fraunhofer Institute for Secure Information Technology (SIT)

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability when handling certain JavaScripts. This occurs as the application fails to validate the cPath parameter in the exportXFAData method and is thus forced to write to the Startup folder with an .hta file that can execute arbitrary code after a restart. (CVE-2023-27363)

• Andrea Micalizzi aka rgod working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Remote Code Execution vulnerability and crash when parsing certain XLS or DOC files. This occurs as the application opens the XLS or DOC file with the default permissions and allows for the execution of macros without proper restrictions or consents from users. (CVE-2023-27364, CVE-2023-27365)

• kimiya working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference or Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the access of null pointer or freed memory without proper validation when handling certain JavaScripts. (CVE-2023-27366)

• Suyue Guo, Wei You from Renmin University of China
• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Local Privilege Escalation vulnerability. This occurs as the original executable file of the registered service with system-level permissions can be hijacked by users with normal permissions when the application is installed in a non-standard directory.

• Will Dormann of Vul Labs

Addressed a potential issue where the application could be terminated by force when data overflow was detected in XFA JavaScripts.

• Philip Kolvenbach of Fraunhofer Institute for Secure Information Technology (SIT)

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability when handling certain JavaScripts. This occurs as the application fails to validate the cPath parameter in the exportXFAData method and is thus forced to write to the Startup folder with an .hta file that can execute arbitrary code after a restart. (CVE-2023-27363)

• Andrea Micalizzi aka rgod working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Remote Code Execution vulnerability and crash when parsing certain XLS or DOC files. This occurs as the application opens the XLS or DOC file with the default permissions and allows for the execution of macros without proper restrictions or consents from users. (CVE-2023-27364, CVE-2023-27365)

• kimiya working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference or Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the access of null pointer or freed memory without proper validation when handling certain JavaScripts. (CVE-2023-27366)

• Suyue Guo, Wei You from Renmin University of China
• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Local Privilege Escalation vulnerability. This occurs as the original executable file of the registered service with system-level permissions can be hijacked by users with normal permissions when the application is installed in a non-standard directory.

• Will Dormann of Vul Labs

Addressed a potential issue where the application could be terminated by force when data overflow was detected in XFA JavaScripts.

• Philip Kolvenbach of Fraunhofer Institute for Secure Information Technology (SIT)

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Write vulnerability and crash when opening certain PDFs that contain JavaScripts with too much text specified in certain controls, which could be exploited by attackers to execute arbitrary code. This occurs due to the access of data outside the bounds as the application fails to validate the length of the input parameter when calling certain API functions from the GDI library.

• Suyue Guo, Wei You from Renmin University of China

Addressed a potential issue where the application could be exposed to Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the use of object or pointer that has been freed when executing certain JavaScripts in PDF files. (CVE-2022-43649)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the use of object or pointer that has been freed when executing certain JavaScripts in PDF files. (CVE-2023-27331, CVE-2023-27330, CVE-2023-27329)

• Anonymous working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Write vulnerability and crash when opening certain PDFs that contain JavaScripts with too much text specified in certain controls, which could be exploited by attackers to execute arbitrary code. This occurs due to the access of data outside the bounds as the application fails to validate the length of the input parameter when calling certain API functions from the GDI library.

• Suyue Guo, Wei You from Renmin University of China

Addressed a potential issue where the application could be exposed to Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the use of object or pointer that has been freed when executing certain JavaScripts in PDF files. (CVE-2022-43649)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the use of object or pointer that has been freed when executing certain JavaScripts in PDF files. (CVE-2023-27331, CVE-2023-27330, CVE-2023-27329)

• Anonymous working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Information Disclosure vulnerability due to the improper encryption when collecting the user clicks of the banner ads and other potential issues as the web server that stores the advertisement logs and information is outdated (Foxit PDF Reader only).

• Tom van den Enden

Addressed potential issues where the application could be exposed to Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the use of object or pointer that has been freed when executing certain JavaScripts in PDF files. (CVE-2023-27331, CVE-2023-27330, CVE-2023-27329)

• Anonymous working with Trend Micro
  Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Read Access Violation, Use-after-Free, or Out-of-Bounds Read vulnerability and crash when parsing certain U3D files, which could be exploited by attackers to execute remote code or disclose information. This occurs as the application accesses the array or iterator outside the bounds, or uses the wild pointer or object that has been freed without proper validation. (CVE-2022-43637, CVE-2022-43638, CVE-2022-43639, CVE-2022-43640, CVE-2022-43641)

• Milan Kyselica
• Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the use of null pointer without proper validation when parsing certain PDF files that contain the invalid Page object, or access of the array outside the bounds resulting from the logic error when parsing certain PDF files whose colSpan attribute is set beyond the maximum length allowed.

• Park Hyeon (@tree_segment) of TeamH4C
• soiax

Addressed potential issues where the application could be exposed to Stack Overrun or Stack Exhaustion vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the array access violation when handling certain PDF files containing a field that is formatted as “Percent” with an overly large value, or due to the infinite recursion resulting from the self-referenced object or incorrect hierarchy structure of nodes when handling certain PDF or XFA files.

• soiax

Addressed a potential issue where the application could be exposed to Arbitrary File Execution vulnerability. This occurs as the application fails to validate the file when updating a plugin with the .fzip file.

• hujin

Addressed potential issues where the application could be exposed to Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the use of object or pointer that has been freed when executing certain JavaScripts in PDF files. (CVE-2022-32774, CVE-2022-38097, CVE-2022-37332, CVE-2022-40129)

• Aleksandar Nikolic of Cisco Talos

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Read Access Violation, Use-after-Free, or Out-of-Bounds Read vulnerability and crash when parsing certain U3D files, which could be exploited by attackers to execute remote code or disclose information. This occurs as the application accesses the array or iterator outside the bounds, or uses the wild pointer or object that has been freed without proper validation. (CVE-2022-43637, CVE-2022-43638, CVE-2022-43639, CVE-2022-43640, CVE-2022-43641)

• Milan Kyselica
• Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the use of null pointer without proper validation when parsing certain PDF files that contain the invalid Page object, or access of the array outside the bounds resulting from the logic error when parsing certain PDF files whose colSpan attribute is set beyond the maximum length allowed.

• Park Hyeon (@tree_segment) of TeamH4C
• soiax

Addressed potential issues where the application could be exposed to Stack Overrun or Stack Exhaustion vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the array access violation when handling certain PDF files containing a field that is formatted as “Percent” with an overly large value, or due to the infinite recursion resulting from the self-referenced object or incorrect hierarchy structure of nodes when handling certain PDF or XFA files.

• soiax

Addressed a potential issue where the application could be exposed to Arbitrary File Execution vulnerability. This occurs as the application fails to validate the file when updating a plugin with the .fzip file.

• hujin

Addressed potential issues where the application could be exposed to Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the use of object or pointer that has been freed when executing certain JavaScripts in PDF files. (CVE-2022-32774, CVE-2022-38097, CVE-2022-37332, CVE-2022-40129)

• Aleksandar Nikolic of Cisco Talos

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Write vulnerability and crash when opening certain PDFs that contain JavaScripts with too much text specified in certain controls, which could be exploited by attackers to execute arbitrary code. This occurs due to the access of data outside the bounds as the application fails to validate the length of the input parameter when calling certain API functions from the GDI library.

• Suyue Guo, Wei You from Renmin University of China

Addressed a potential issue where the application could be exposed to Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the use of object or pointer that has been freed when executing certain JavaScripts in PDF files. (CVE-2022-43649)

• Anonymous working with Trend
  Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Denial of Service vulnerability and crash. This occurs as the application uses the null pointer or element in the null array without proper validation when handling certain JavaScripts.

• China Information Technology Innovation Vulnerability Database (CITIVD)

Addressed potential issues where the application could be exposed to Read Access Violation vulnerability and crash when parsing certain U3D files. This occurs as the application accesses the array outside the bounds.

• Milan Kyselica

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the access of the array outside the bounds resulting from the logic error when parsing certain PDF files whose colSpan attribute is set beyond the maximum length allowed.

• Park Hyeon (@tree_segment) of TeamH4C
• soiax

Addressed potential issues where the application could be exposed to Stack Overrun or Stack Exhaustion vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the array access violation when handling certain PDF files containing a field that is formatted as “Percent” with an overly large value, or due to the infinite recursion resulting from the incorrect hierarchy structure of nodes when handling certain PDF or XFA files.

• soiax

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Read Access Violation, Use-after-Free, or Out-of-Bounds Read vulnerability and crash when parsing certain U3D files, which could be exploited by attackers to execute remote code or disclose information. This occurs as the application accesses the array or iterator outside the bounds, or uses the wild pointer or object that has been freed without proper validation. (CVE-2022-43637, CVE-2022-43638, CVE-2022-43639, CVE-2022-43640, CVE-2022-43641)

• Milan Kyselica
• Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the use of null pointer without proper validation when parsing certain PDF files that contain the invalid Page object, or access of the array outside the bounds resulting from the logic error when parsing certain PDF files whose colSpan attribute is set beyond the maximum length allowed.

• Park Hyeon (@tree_segment) of TeamH4C
• soiax

Addressed potential issues where the application could be exposed to Stack Overrun or Stack Exhaustion vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the array access violation when handling certain PDF files containing a field that is formatted as “Percent” with an overly large value, or due to the infinite recursion resulting from the self-referenced object or incorrect hierarchy structure of nodes when handling certain PDF or XFA files.

• soiax

Addressed a potential issue where the application could be exposed to Arbitrary File Execution vulnerability. This occurs as the application fails to validate the file when updating a plugin with the .fzip file.

• hujin

Addressed potential issues where the application could be exposed to Use-after-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the use of object or pointer that has been freed when executing certain JavaScripts in PDF files. (CVE-2022-32774, CVE-2022-38097, CVE-2022-37332, CVE-2022-40129)

• Aleksandar Nikolic of Cisco Talos

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Denial of Service vulnerability and crash. This occurs as the application uses the null pointer or element in the null array without proper validation when handling certain JavaScripts.

• China Information Technology Innovation Vulnerability Database (CITIVD)

Addressed potential issues where the application could be exposed to Read Access Violation vulnerability and crash when parsing certain U3D files. This occurs as the application accesses the array outside the bounds.

• Milan Kyselica

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the access of the array outside the bounds resulting from the logic error when parsing certain PDF files whose colSpan attribute is set beyond the maximum length allowed.

• Park Hyeon (@tree_segment) of TeamH4C
• soiax

Addressed potential issues where the application could be exposed to Stack Overrun or Stack Exhaustion vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the array access violation when handling certain PDF files containing a field that is formatted as “Percent” with an overly large value, or due to the infinite recursion resulting from the incorrect hierarchy structure of nodes when handling certain PDF or XFA files.

• soiax

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Uninitialized Variable vulnerability and crash when handling certain JavaScripts, which could be exploited by attackers to disclose information. This occurs as the application uses V8 JavaScript Engine in the outdated version that is prone to vulnerabilities.

• DoHyun Lee(@l33d0hyun) of DNSLab, Korea University

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read, Type Confusion, Use-After-Free, or Uninitialized Variable vulnerability and crash when handling certain JavaScripts, which could be exploited by attackers to disclose information or execute remote code. This occurs as the application uses V8 JavaScript Engine in the outdated version that is prone to vulnerabilities. (CVE-2022-37376, CVE-2022-37377, CVE-2022-37378)

• Seungju Oh (@real_as3617) , DoHyun Lee (@l33d0hyun) of Zerocution working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) of DNSLab, Korea University working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) of DNSLab, Korea University
• René Freingruber, SEC Consult Vulnerability Lab

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the access of null pointer, handle, or array without proper validation. (CVE-2022-26979, CVE-2022-27944, CVE-2022-27359)

• Suyue Guo, Wei You from Renmin University of China

Addressed potential issues where the application could be exposed to Use-After-Free Information Disclosure or Memory Corruption Remote Code Execution vulnerability and crash. This occurs due to the access of illegal address as the application fails to update the pointer after the container is expanded during the iteration when handling the AFSpecial_KeystrokeEx method. (CVE-2022-37379, CVE-2022-37381)

• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information or execute remote code. This occurs as the application does not set the pointer as null after it has been released and releases the pointer again during the subsequent destruction when handling certain PDF files, or fails to handle the abnormal parameters during the process to create database API by calling the functions from Windows system when handling ADBC objects, or transforms objects by force without judging the data type when handling Doc objects. (CVE-2022-37380, CVE-2022-37383, CVE-2022-37388)

• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative
• soiax working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information or execute remote code. This occurs due to the access or use of wild pointer or released object without proper validation when handling certain JavaScripts, Doc objects, or AcroForms. (CVE-2022-37382, CVE-2022-37384, CVE-2022-37385, CVE-2022-37389, CVE-2022-37386, CVE-2022-37390, CVE-2022-37387, CVE-2022-37391)

• Anonymous working with Trend Micro Zero Day Initiative
• Krishnakant Patil and Ashfaq Ansari - HackSys Inc
• Krishnakant Patil and Ashfaq Ansari - HackSys Inc working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when parsing the data stream in certain PDF files. This occurs due to the access violation caused by the incorrectly allocated memory as an overflow exists during the memory calculation. (CNVD-C-2022-280049)

• China National Vulnerability Database

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information. This occurs as the application fails to properly validate the allocation boundaries for objects when handling certain JavaScripts. (CVE-2022-34873, CVE-2022-34875, CVE-2022-34874)

• KMFL working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative
• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Use-After-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs as the application uses the null pointer without proper validation after the Page object has been deleted when opening certain PDF files in the Full Screen mode.

• Milan Kyselica

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read, Type Confusion, Use-After-Free, or Uninitialized Variable vulnerability and crash when handling certain JavaScripts, which could be exploited by attackers to disclose information or execute remote code. This occurs as the application uses V8 JavaScript Engine in the outdated version that is prone to vulnerabilities. (CVE-2022-37376, CVE-2022-37377, CVE-2022-37378)

• Seungju Oh (@real_as3617) , DoHyun Lee (@l33d0hyun) of Zerocution working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) of DNSLab, Korea University working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) of DNSLab, Korea University
• René Freingruber, SEC Consult Vulnerability Lab

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the access of null pointer, handle, or array without proper validation. (CVE-2022-26979, CVE-2022-27944, CVE-2022-27359)

• Suyue Guo, Wei You from Renmin University of China

Addressed potential issues where the application could be exposed to Use-After-Free Information Disclosure or Memory Corruption Remote Code Execution vulnerability and crash. This occurs due to the access of illegal address as the application fails to update the pointer after the container is expanded during the iteration when handling the AFSpecial_KeystrokeEx method. (CVE-2022-37379, CVE-2022-37381)

• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information or execute remote code. This occurs as the application does not set the pointer as null after it has been released and releases the pointer again during the subsequent destruction when handling certain PDF files, or fails to handle the abnormal parameters during the process to create database API by calling the functions from Windows system when handling ADBC objects, or transforms objects by force without judging the data type when handling Doc objects. (CVE-2022-37380, CVE-2022-37383, CVE-2022-37388)

• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative
• soiax working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information or execute remote code. This occurs due to the access or use of wild pointer or released object without proper validation when handling certain JavaScripts, Doc objects, or AcroForms. (CVE-2022-37382, CVE-2022-37384, CVE-2022-37385, CVE-2022-37389, CVE-2022-37386, CVE-2022-37390, CVE-2022-37387, CVE-2022-37391)

• Anonymous working with Trend Micro Zero Day Initiative
• Krishnakant Patil and Ashfaq Ansari - HackSys Inc
• Krishnakant Patil and Ashfaq Ansari - HackSys Inc working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when parsing the data stream in certain PDF files. This occurs due to the access violation caused by the incorrectly allocated memory as an overflow exists during the memory calculation. (CNVD-C-2022-280049)

• China National Vulnerability Database

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information. This occurs as the application fails to properly validate the allocation boundaries for objects when handling certain JavaScripts. (CVE-2022-34873, CVE-2022-34875, CVE-2022-34874)

• KMFL working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative
• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Use-After-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs as the application uses the null pointer without proper validation after the Page object has been deleted when opening certain PDF files in the Full Screen mode.

• Milan Kyselica

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Use-After-Free vulnerability. This occurs as the application executes the destructor under png_safe_execute. (CVE-2019-7317)

• Lian Gao and Heng Yin from University of California, Riverside

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read, Type Confusion, Use-After-Free, or Uninitialized Variable vulnerability and crash when handling certain JavaScripts, which could be exploited by attackers to disclose information or execute remote code. This occurs as the application uses V8 JavaScript Engine in the outdated version that is prone to vulnerabilities. (CVE-2022-37376, CVE-2022-37377, CVE-2022-37378)

• Seungju Oh (@real_as3617) , DoHyun Lee (@l33d0hyun) of Zerocution working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) of DNSLab, Korea University working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) of DNSLab, Korea University
• René Freingruber, SEC Consult Vulnerability Lab

Addressed potential issues where the application could be exposed to Null Pointer Dereference vulnerability and crash, which could be exploited by attackers to cause a denial of service. This occurs due to the access of null pointer, handle, or array without proper validation. (CVE-2022-26979, CVE-2022-27944, CVE-2022-27359)

• Suyue Guo, Wei You from Renmin University of China

Addressed potential issues where the application could be exposed to Use-After-Free Information Disclosure or Memory Corruption Remote Code Execution vulnerability and crash. This occurs due to the access of illegal address as the application fails to update the pointer after the container is expanded during the iteration when handling the AFSpecial_KeystrokeEx method. (CVE-2022-37379, CVE-2022-37381)

• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information or execute remote code. This occurs as the application does not set the pointer as null after it has been released and releases the pointer again during the subsequent destruction when handling certain PDF files, or fails to handle the abnormal parameters during the process to create database API by calling the functions from Windows system when handling ADBC objects, or transforms objects by force without judging the data type when handling Doc objects. (CVE-2022-37380, CVE-2022-37383, CVE-2022-37388)

• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative
• soiax working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information or execute remote code. This occurs due to the access or use of wild pointer or released object without proper validation when handling certain JavaScripts, Doc objects, or AcroForms. (CVE-2022-37382, CVE-2022-37384, CVE-2022-37385, CVE-2022-37389, CVE-2022-37386, CVE-2022-37390, CVE-2022-37387, CVE-2022-37391)

• Anonymous working with Trend Micro Zero Day Initiative
• Krishnakant Patil and Ashfaq Ansari - HackSys Inc
• Krishnakant Patil and Ashfaq Ansari - HackSys Inc working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when parsing the data stream in certain PDF files. This occurs due to the access violation caused by the incorrectly allocated memory as an overflow exists during the memory calculation. (CNVD-C-2022-280049)

• China National Vulnerability Database

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Uninitialized Variable vulnerability and crash when handling certain JavaScripts, which could be exploited by attackers to disclose information. This occurs as the application uses V8 JavaScript Engine in the outdated version that is prone to vulnerabilities.

• DoHyun Lee(@l33d0hyun) of DNSLab, Korea University

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to disclose information. This occurs as the application fails to properly validate the allocation boundaries for objects when handling certain JavaScripts. (CVE-2022-34873, CVE-2022-34875, CVE-2022-34874)

• KMFL working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative
• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Use-After-Free vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs as the application uses the null pointer without proper validation after the Page object has been deleted when opening certain PDF files in the Full Screen mode.

• Milan Kyselica

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Null Pointer Dereference Denial of Service vulnerability and crash. This is caused by the parsing error when executing JavaScripts in certain PDF files. (CNVD-C-2021-205525)

• Xu Peng from UCAS and Ying Lingyun from QiAnXin Technology Research Institute
• China National Vulnerability Database

Addressed a potential issue where the application could be exposed to Read Access Violation vulnerability and crash. This occurs due to the use of null pointer without proper validation as the application fails to get the CF dictionary when handling certain encrypted PDFs with abnormal encryption dictionary.

• Milan Kyselica

Addressed a potential issue where the application could be exposed to Incremental Saving Attack and Shadow Attack and deliver incorrect signature information when handling certain signed PDF files. This is caused by the parsing error as the parsing engine fails to use the cross-reference information correctly when parsing certain compressed objects. (CVE-2022-25641)

• Raphael Sütterlin, Vladislav Mladenov, Christian Mainka, Simon Rohlmann, and Jörg Schwenk of the Ruhr-Universität Bochum, Chair for Network and Data Security

Addressed potential issues where the application could be exposed to Type Confusion vulnerability and crash when executing certain JavaScripts. This occurs due to the improper compiling for an Unsigned32 result in the V8 JavaScript Engine. (CVE-2022-30557)

• DoHyun Lee(@l33d0hyun)

Addressed potential issues where the application could be exposed to Out-of-Bounds Read Information Disclosure or Use-After-Free Remote Code Execution vulnerability and crash when handling certain Acroforms, Doc objects, or Annotation objects. This occurs as the application uses the pointer/variable/object or accesses the memory that has been freed without proper validation. (CVE-2022-28670, CVE-2022-28669, CVE-2022-28671, CVE-2022-28672, CVE-2022-28673, CVE-2022-28675, CVE-2022-28676, CVE-2022-28674, CVE-2022-28678, CVE-2022-28680, CVE-2022-28679)

• Anonymous working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash. This occurs due to the use of object that has been freed as the application fails to update the copy of the pointer after a page is deleted when executing the deletePages method. (CVE-2022-28677, CVE-2022-28681, CVE-2022-28683)

• Anonymous working with Trend Micro Zero Day Initiative
• KMFL working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs as the application fails to properly validate the allocation boundaries for objects when handling certain JavaScripts. (CVE-2022-28682)

• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Null Pointer Dereference Denial of Service vulnerability and crash. This is caused by the parsing error when executing JavaScripts in certain PDF files. (CNVD-C-2021-205525)

• Xu Peng from UCAS and Ying Lingyun from QiAnXin Technology Research Institute
• China National Vulnerability Database

Addressed a potential issue where the application could be exposed to Read Access Violation vulnerability and crash. This occurs due to the use of null pointer without proper validation as the application fails to get the CF dictionary when handling certain encrypted PDFs with abnormal encryption dictionary.

• Milan Kyselica

Addressed a potential issue where the application could be exposed to Incremental Saving Attack and Shadow Attack and deliver incorrect signature information when handling certain signed PDF files. This is caused by the parsing error as the parsing engine fails to use the cross-reference information correctly when parsing certain compressed objects. (CVE-2022-25641)

• Raphael Sütterlin, Vladislav Mladenov, Christian Mainka, Simon Rohlmann, and Jörg Schwenk of the Ruhr-Universität Bochum, Chair for Network and Data Security

Addressed potential issues where the application could be exposed to Type Confusion vulnerability and crash when executing certain JavaScripts. This occurs due to the improper compiling for an Unsigned32 result in the V8 JavaScript Engine. (CVE-2022-30557)

• DoHyun Lee(@l33d0hyun)

Addressed potential issues where the application could be exposed to Out-of-Bounds Read Information Disclosure or Use-After-Free Remote Code Execution vulnerability and crash when handling certain Acroforms, Doc objects, or Annotation objects. This occurs as the application uses the pointer/variable/object or accesses the memory that has been freed without proper validation. (CVE-2022-28670, CVE-2022-28669, CVE-2022-28671, CVE-2022-28672, CVE-2022-28673, CVE-2022-28675, CVE-2022-28676, CVE-2022-28674, CVE-2022-28678, CVE-2022-28680, CVE-2022-28679)

• Anonymous working with Trend Micro Zero Day Initiative
• Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash. This occurs due to the use of object that has been freed as the application fails to update the copy of the pointer after a page is deleted when executing the deletePages method. (CVE-2022-28677, CVE-2022-28681, CVE-2022-28683)

• Anonymous working with Trend Micro Zero Day Initiative
• KMFL working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs as the application fails to properly validate the allocation boundaries for objects when handling certain JavaScripts. (CVE-2022-28682)

• Suyue Guo and Wei You from Renmin University of China working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Stack-Based Buffer Overflow vulnerability and crash. This occurs due to the use of abnormal data without proper validation when handling an XFA file that contains improper attribute values in the node of a widget. (CVE-2022-24954)

• DoHyun Lee(@l33d0hyun) and JaeHyuk Lim
• DoHyun Lee(@l33d0hyun)

Addressed potential issues where the application could be exposed to Out-of-Bounds Read, Heap Overflow, Memory Corruption, Null Pointer Dereference, or Stack Buffer Overflow vulnerability and crash when converting certain PDF files to Office files. This occurs as the application reads data outside the bounds, accesses the memory that is modified invalidly, uses the null pointer, or reads or writes the data beyond the stack buffer. (CVE -2021-40729, CVE-2021-44709, ZS-VR-21-106, ZS-VR-21-107, ZS-VR-21-108, ZS-VR-21-109, CVE-2021-44740, CVE-2021-44741, CVE-2021-44708, ZS-VR-21-116)

• Kai Lu of Zscaler's ThreatLabz

Addressed a potential issue where the application could be exposed to Memory Leak or Out-of-Bounds Read/Write vulnerability and crash. This occurs as the V8 JavaScript Engine does not take into account that the value of a variable type can be changed to “NaN” through addition or subtraction of Infinities, and fails to properly check and handle the abnormal data while handling the JavaScript.

• Dongjun shin(@__sindo)

Addressed potential issues where the application could be exposed to Null Pointer Dereference or Array Out-of-Bounds vulnerability and crash when parsing certain PDF files. This occurs due to the use of null pointer or invalid object without proper validation. (CVE-2022-25108)

• DoHyun Lee(@l33d0hyun) and SeungJu Oh(@real_as3617)

Addressed a potential issue where the application could be exposed to Uncontrolled Search Path Element Privilege Escalation vulnerability, which could be exploited by attackers to execute malicious DLL files. This occurs as the application does not specify an absolute path when searching the DLL library. (CVE-2022-24955)

• DoHyun Lee(@l33d0hyun)

Addressed a potential issue where the application could be exposed to Information Disclosure vulnerability when processing the format specifiers. This occurs as the util.printf function fails to handle the %llx format string properly.

• Trifescu Stefan-Octavian

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Read Remote Code Execution vulnerability and crash when deleting pages in certain PDF files using the JavaScript API. This occurs due to the use of freed object or read of data beyond the boundaries as the application incorrectly deletes the page view even though the PDF engine has not successfully deleted the page. (CVE-2022-24359, CVE-2022-24358)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when handling certain Annotation objects, Doc objects or Acroforms. This occurs due to the use of wild pointers or freed objects without proper validation. (CVE-2022-24357, CVE-2022-24360, CVE-2022-24363, CVE-2022-24362, CVE-2021-40420, CVE-2022-24364, CVE-2022-24365, CVE-2022-24366, CVE-2022-24367, CVE-2022-24368)

• Anonymous working with Trend Micro Zero Day Initiative
• Aleksandar Nikolic of Cisco Talos
• Ashfaq Ansari and Krishnakant Patil - HackSys Inc working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Out-of-Bounds Read/Write Remote Code Execution vulnerability and crash when parsing certain JPEG2000 or JP2 files with relatively large values in their attributes. This is caused by the memory access violation due to the incorrectly-calculated value as an overflow occurs when calculating the memory size or buffer size to be allocated. (CVE-2022-24361, CVE-2022-24971, CVE-2022-24369, CVE-2022-24907, CVE-2022-24908)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Read Access Violation vulnerability and crash when parsing certain U3D files. This occurs due to the use of invalid pointer without proper validation.

• Milan Kyselica

Addressed a potential issue where the application could be exposed to Read Access Violation vulnerability and crash when parsing certain PDF files. This occurs as the application gets the null dictionary object since the EFF information getting from the PDF file does not match the actual dictionary name, and uses the null dictionary object without proper validation.

• Milan Kyselica

Addressed a potential issue where the application could be exposed to Memory Corruption vulnerability and crash when handling certain methods in JavaScript. This is caused by the array out-of-bounds error due to the lack of proper validation for the parameter in the method. (CVE-2022-22150)

• Aleksandar Nikolic of Cisco Talos

Addressed an issue where the application could be exposed to various attacks if the XML configuration file of the iManage 10 plugin's logging function was modified. (CVE-2018-1285)

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Stack-Based Buffer Overflow vulnerability and crash. This occurs due to the use of abnormal data without proper validation when handling an XFA file that contains improper attribute values in the node of a widget. (CVE-2022-24954)

• DoHyun Lee(@l33d0hyun) and JaeHyuk Lim
• DoHyun Lee(@l33d0hyun)

Addressed potential issues where the application could be exposed to Out-of-Bounds Read, Heap Overflow, Memory Corruption, Null Pointer Dereference, or Stack Buffer Overflow vulnerability and crash when converting certain PDF files to Office files. This occurs as the application reads data outside the bounds, accesses the memory that is modified invalidly, uses the null pointer, or reads or writes the data beyond the stack buffer. (CVE -2021-40729, CVE-2021-44709, ZS-VR-21-106, ZS-VR-21-107, ZS-VR-21-108, ZS-VR-21-109, CVE-2021-44740, CVE-2021-44741, CVE-2021-44708, ZS-VR-21-116)

• Kai Lu of Zscaler's ThreatLabz

Addressed a potential issue where the application could be exposed to Memory Leak or Out-of-Bounds Read/Write vulnerability and crash. This occurs as the V8 JavaScript Engine does not take into account that the value of a variable type can be changed to “NaN” through addition or subtraction of Infinities, and fails to properly check and handle the abnormal data while handling the JavaScript.

• Dongjun shin(@__sindo)

Addressed potential issues where the application could be exposed to Null Pointer Dereference or Array Out-of-Bounds vulnerability and crash when parsing certain PDF files. This occurs due to the use of null pointer or invalid object without proper validation. (CVE-2022-25108)

• DoHyun Lee(@l33d0hyun) and SeungJu Oh(@real_as3617)

Addressed a potential issue where the application could be exposed to Uncontrolled Search Path Element Privilege Escalation vulnerability, which could be exploited by attackers to execute malicious DLL files. This occurs as the application does not specify an absolute path when searching the DLL library. (CVE-2022-24955)

• DoHyun Lee(@l33d0hyun)

Addressed a potential issue where the application could be exposed to Information Disclosure vulnerability when processing the format specifiers. This occurs as the util.printf function fails to handle the %llx format string properly.

• Trifescu Stefan-Octavian

Addressed potential issues where the application could be exposed to Use-After-Free or Out-of-Bounds Read Remote Code Execution vulnerability and crash when deleting pages in certain PDF files using the JavaScript API. This occurs due to the use of freed object or read of data beyond the boundaries as the application incorrectly deletes the page view even though the PDF engine has not successfully deleted the page. (CVE-2022-24359, CVE-2022-24358)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when handling certain Annotation objects, Doc objects or Acroforms. This occurs due to the use of wild pointers or freed objects without proper validation. (CVE-2022-24357, CVE-2022-24360, CVE-2022-24363, CVE-2022-24362, CVE-2021-40420, CVE-2022-24364, CVE-2022-24365, CVE-2022-24366, CVE-2022-24367, CVE-2022-24368)

• Anonymous working with Trend Micro Zero Day Initiative
• Aleksandar Nikolic of Cisco Talos
• Ashfaq Ansari and Krishnakant Patil - HackSys Inc working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Out-of-Bounds Read/Write Remote Code Execution vulnerability and crash when parsing certain JPEG2000 or JP2 files with relatively large values in their attributes. This is caused by the memory access violation due to the incorrectly-calculated value as an overflow occurs when calculating the memory size or buffer size to be allocated. (CVE-2022-24361, CVE-2022-24971, CVE-2022-24369, CVE-2022-24907, CVE-2022-24908)

• Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Read Access Violation vulnerability and crash when parsing certain U3D files. This occurs due to the use of invalid pointer without proper validation.

• Milan Kyselica

Addressed a potential issue where the application could be exposed to Read Access Violation vulnerability and crash when parsing certain PDF files. This occurs as the application gets the null dictionary object since the EFF information getting from the PDF file does not match the actual dictionary name, and uses the null dictionary object without proper validation.

• Milan Kyselica

Addressed a potential issue where the application could be exposed to Memory Corruption vulnerability and crash when handling certain methods in JavaScript. This is caused by the array out-of-bounds error due to the lack of proper validation for the parameter in the method. (CVE-2022-22150)

• Aleksandar Nikolic of Cisco Talos

Addressed an issue where the application could be exposed to various attacks if the XML configuration file of the iManage 10 plugin's logging function was modified. (CVE-2018-1285)

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read Information Disclosure vulnerability and crash. This occurs due to the data access violation caused by the array out-of-bounds error as the application fails to validate the object properly while handling the width attribute of certain XFA widget (CVE-2022-24370).

• DoHyun Lee(@l33d0hyun) working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read Remote Code Execution vulnerability and crash. This occurs as the application fails to delete the page object timely after a page has been deleted (CVE-2022-24356).

• DoHyun Lee(@l33d0hyun) working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Null Pointer Dereference or Read Access Violation vulnerability and crash. This occurs when handling certain malformed PDF files due to the use of null pointer, wild pointer, void pointer, or uninitialized pointer without proper validation. (CNVD-C-2021-205496, CNVD-C-2021-205515, CNVD-C-2021-205541)

• JaeHyuk Lim and DoHyun Lee(@l33d0hyun)
• Milan Kyselica of IstroSec
• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute
• China National Vulnerability Database

Addressed potential issues where the application could be exposed to Pointer Dereference Remote Code Execution or Out-of-Bounds Read/Write vulnerability and crash when converting certain PDF files to Office files. This occurs as the application uses or accesses the freed pointer or uninitialized variable or reads/writes values outside the bounds.

• Ariele Caltabiano (kimiya)
• Haboob Lab

Addressed potential issues where the application could be exposed to NTLM v2 Authentication Leak or Use-after-Free vulnerability and crash. This occurs as the browser add-on converts the URL path by mistake when processing the URL that is not truly accessible, or fails to use the com API properly during the download process.

• j00sean

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, Read Access Violation, Null Pointer Dereference, or Uninitialized Memory Access vulnerability and crash, which could be exploited by attackers to execute remote code, disclose information, or cause denial of service. This occurs due to the use or access of memory, pointer, or object that has been freed without proper validation when handling certain JavaScripts or annotation objects. (CVE-2021-34948/CNVD-C-2021-247425, CVE-2021-34950, CVE-2021-34953, CVE-2021-34952/CNVD-C-2021-247417, CNVD-C-2021-205550, CVE-2021-34968, CVE-2021-34969/CNVD-C-2021-247399, CVE-2021-34972, CNVD-C-2021-247393, CNVD-C-2021-247404, CNVD-C-2021-247448, CNVD-C-2021-247458, CNVD-C-2021-247464, CVE-2021-41780, CVE-2021-41785, CVE-2021-41783, CVE-2021-41782, CVE-2021-41784, CVE-2021-41781, CVE-2021-34974, CVE-2021-34975)

• ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group working with Trend Micro Zero Day Initiative
• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute
• ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group
• Milan Kyselica of IstroSec
• China National Vulnerability Database
• cor3sm4sh3r working with Volon Cyber Security Pvt Ltd working with Trend Micro Zero Day Initiative
• Steven Seeley of Qihoo 360 Vulcan Team
• Rich working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Out-of-Bounds Read, Use-after-Free, or Type Confusion vulnerability and crash, which could be exploited by attackers to disclose information or execute remote code. This occurs when handling certain objects since the application transforms objects by force without judging the data type and uses the void pointer or memory without proper validation. (CVE-2021-34949, CVE-2021-34951/CNVD-C-2021-247436, CVE-2021-34954, CVE-2021-34955, CVE-2021-34956, CVE-2021-34957, CVE-2021-34958, CVE-2021-34959, CVE-2021-34965, CVE-2021-34960, CVE-2021-34961, CVE-2021-34962, CVE-2021-34963, CVE-2021-34964, CVE-2021-34966, CVE-2021-34967)

• ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group working with Trend Micro Zero Day Initiative
• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute
• cor3sm4sh3r working with Volon Cyber Security Pvt Ltd working with Trend Micro Zero Day Initiative
• Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Arbitrary File Write vulnerability when verifying digital signatures in certain PDF files, which could be exploited by attackers to display the controlled contents. This occurs due to the lack of proper validation for the hidden and incremental data in the digitally signed PDF files. (CVE-2021-40326)

• Vladislav Mladenov, Simon Rohlmann, Christian Mainka, and Jörg Schwenk of the Ruhr-Universität Bochum, Chair for Network and Data Security

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash. This occurs when handling JavaScript in certain PDF files due to the access of arrays outside the bounds without proper validation.

• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute

Addressed potential issues where the application could be exposed to Stack Overflow or Denial of Service vulnerability and crash. This is caused by the infinite loop, infinite mutual recursion or improper buffer management mechanism while handling certain JavaScripts.

• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute

Addressed a potential issue where the application could be exposed to Denial of Service vulnerability and crash when handling certain PDF files that contain illegal dictionary entries or incorrect Outlines (CNVD-C-2021-247433).

• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute
• China National Vulnerability Database

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash. This occurs when getting the embedded fonts in certain PDF files as the bytes read exceed the stream length. (CVE-2021-34976, CVE-2021-34973)

• Milan Kyselica of IstroSec working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) and Jeonghoon Shin(@singi21a) of KITRI "BEST OF THE BEST" working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Information Disclosure vulnerability when processing the format specifiers. This occurs as the util.printf function fails to handle the format extension properly. (CVE-2021-34970)

• sindo working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Heap-based Buffer Overflow Remote Code Execution vulnerability and crash. This occurs as the application writes the data based on the wrong region calculated when parsing certain JPEG2000 files. (CVE-2021-34971)

• Milan Kyselica of IstroSec working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Arbitrary File Execution vulnerability when handling attachments or submitting forms. This occurs due to the lack of proper validation of the file suffix and file path.

• Pontus Keski-Pukkila of Hoxhunt

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Null Pointer Dereference or Read Access Violation vulnerability and crash. This occurs when handling certain malformed PDF files due to the use of null pointer, wild pointer, void pointer, or uninitialized pointer without proper validation. (CNVD-C-2021-205496, CNVD-C-2021-205515, CNVD-C-2021-205541)

• rwxcode of nsfocus security team
• JaeHyuk Lim and DoHyun Lee(@l33d0hyun)
• Milan Kyselica of IstroSec
• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute
• China National Vulnerability Database

Addressed potential issues where the application could be exposed to Pointer Dereference Remote Code Execution or Out-of-Bounds Read/Write vulnerability and crash when converting certain PDF files to Office files. This occurs as the application uses or accesses the freed pointer or uninitialized variable or reads/writes values outside the bounds.

• Ariele Caltabiano (kimiya)
• Haboob Lab

Addressed potential issues where the application could be exposed to NTLM v2 Authentication Leak or Use-after-Free vulnerability and crash. This occurs as the browser add-on converts the URL path by mistake when processing the URL that is not truly accessible, or fails to use the com API properly during the download process.

• j00sean

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, Read Access Violation, Null Pointer Dereference, or Uninitialized Memory Access vulnerability and crash, which could be exploited by attackers to execute remote code, disclose information, or cause denial of service. This occurs due to the use or access of memory, pointer, or object that has been freed without proper validation when handling certain JavaScripts or annotation objects. (CVE-2021-34948/CNVD-C-2021-247425, CVE-2021-34950, CVE-2021-34953, CVE-2021-34952/CNVD-C-2021-247417, CNVD-C-2021-205550, CVE-2021-34968, CVE-2021-34969/CNVD-C-2021-247399, CVE-2021-34972, CNVD-C-2021-247393, CNVD-C-2021-247404, CNVD-C-2021-247448, CNVD-C-2021-247458, CNVD-C-2021-247464, CVE-2021-41780, CVE-2021-41785, CVE-2021-41783, CVE-2021-41782, CVE-2021-41784, CVE-2021-41781, CVE-2021-34974, CVE-2021-34975)

• ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group working with Trend Micro Zero Day Initiative
• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute
• ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group
• Milan Kyselica of IstroSec
• China National Vulnerability Database
• cor3sm4sh3r working with Volon Cyber Security Pvt Ltd working with Trend Micro Zero Day Initiative
• Steven Seeley of Qihoo 360 Vulcan Team
• Rich working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Out-of-Bounds Read, Use-after-Free, or Type Confusion vulnerability and crash, which could be exploited by attackers to disclose information or execute remote code. This occurs when handling certain objects since the application transforms objects by force without judging the data type and uses the void pointer or memory without proper validation. (CVE-2021-34949, CVE-2021-34951/CNVD-C-2021-247436, CVE-2021-34954, CVE-2021-34955, CVE-2021-34956, CVE-2021-34957, CVE-2021-34958, CVE-2021-34959, CVE-2021-34965, CVE-2021-34960, CVE-2021-34961, CVE-2021-34962, CVE-2021-34963, CVE-2021-34964, CVE-2021-34966, CVE-2021-34967)

• ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group working with Trend Micro Zero Day Initiative
• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute
• cor3sm4sh3r working with Volon Cyber Security Pvt Ltd working with Trend Micro Zero Day Initiative
• Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Arbitrary File Write vulnerability when verifying digital signatures in certain PDF files, which could be exploited by attackers to display the controlled contents. This occurs due to the lack of proper validation for the hidden and incremental data in the digitally signed PDF files. (CVE-2021-40326)

• Vladislav Mladenov, Simon Rohlmann, Christian Mainka, and Jörg Schwenk of the Ruhr-Universität Bochum, Chair for Network and Data Security

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash. This occurs when handling JavaScript in certain PDF files due to the access of arrays outside the bounds without proper validation.

• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute

Addressed potential issues where the application could be exposed to Stack Overflow or Denial of Service vulnerability and crash. This is caused by the infinite loop, infinite mutual recursion or improper buffer management mechanism while handling certain JavaScripts.

• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute

Addressed a potential issue where the application could be exposed to Denial of Service vulnerability and crash when handling certain PDF files that contain illegal dictionary entries or incorrect Outlines (CNVD-C-2021-247433).

• Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute
• China National Vulnerability Database

Addressed potential issues where the application could be exposed to Out-of-Bounds Read vulnerability and crash. This occurs when getting the embedded fonts in certain PDF files as the bytes read exceed the stream length. (CVE-2021-34976, CVE-2021-34973)

• Milan Kyselica of IstroSec working with Trend Micro Zero Day Initiative
• DoHyun Lee(@l33d0hyun) and Jeonghoon Shin(@singi21a) of KITRI "BEST OF THE BEST" working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Information Disclosure vulnerability when processing the format specifiers. This occurs as the util.printf function fails to handle the format extension properly. (CVE-2021-34970)

• sindo working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Heap-based Buffer Overflow Remote Code Execution vulnerability and crash. This occurs as the application writes the data based on the wrong region calculated when parsing certain JPEG2000 files. (CVE-2021-34971)

• Milan Kyselica of IstroSec working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Arbitrary File Execution vulnerability when handling attachments or submitting forms. This occurs due to the lack of proper validation of the file suffix and file path.

• Pontus Keski-Pukkila of Hoxhunt

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Remote Code Execution vulnerability. This occurs as the application allows the local programs to be opened by executing certain JavaScripts without proper validation (CVE-2021-45978, CVE-2021-45979, CVE-2021-45980).

• DoHyun Lee(@l33d0hyun)

Addressed a potential issue where the application could be exposed to Null Pointer Dereference vulnerability and crash. This occurs when handling certain malformed PDF files due to the use of null pointer without proper validation.

• JaeHyuk Lim and DoHyun Lee(@l33d0hyun)

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read/Write or Null Pointer Dereference vulnerability and crash when parsing certain PDF files. This occurs due to the access violation in the array subscript when storing the offset value for the indirect object because the array size created based on the /Size entry whose value is smaller than the actual maximum indirect object number is not enough to accommodate the data.

xina1i
DoHyun Lee(l33d0hyun)
Milan Kyselica

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read Information Disclosure vulnerability and crash when processing certain arguments. This occurs due to the access of illegal memory as the application fails to restrict the access to an array outside its bounds when calling the util.scand function. (CVE-2021-38564)

Xinyu Wan, Yiwei Zhang and Wei You from Renmin University of China

Addressed potential issues where the application could be exposed to Use-after-Free Remote Code Execution vulnerability and crash when handling certain Javascripts or annotation objects. This occurs due to the use or access of memory, pointer, or object that has been freed without proper validation (CVE-2021-21831, CVE-2021-21870, CVE-2021-34831, CVE-2021-34832, CVE-2021-34847).

Aleksandar Nikolic of Cisco Talos
Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute working with Trend Micro Zero Day Initiative
ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Arbitrary File Write vulnerability when executing the submitForm function. Attackers could exploit this vulnerability to create arbitrary files in the local system and inject the uncontrolled contents.

Hou JingYi (@hjy79425575)

Addressed potential issues where the application could be exposed to Use-after-Free Remote Code Execution vulnerability and crash when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. This occurs as multiple annotation objects are associated to the same Annotation dictionary (CVE-2021-34852, CVE-2021-34834, CVE-2021-34835, CVE-2021-34851, CVE-2021-34836, CVE-2021-34837, CVE-2021-34838, CVE-2021-34839, CVE-2021-34840, CVE-2021-34841, CVE-2021-34833, CVE-2021-34842, CVE-2021-34843, CVE-2021-34844, CVE-2021-34845, CVE-2021-34853).

Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute working with Trend Micro Zero Day Initiative
Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Use-after-Free vulnerability and crash when handling certain events of form elements. This occurs due to the use of Field object that has been cleaned up after executing events using the event.target property (CVE-2021-21893).

Aleksandar Nikolic of Cisco Talos

Addressed a potential issue where the application could be exposed to Stack Overflow vulnerability and crash when parsing XML data with too many embedded nodes. This occurs as the recursion level exceeds the maximum recursion depth when parsing XML nodes using recursion.

Milan Kyselica

Addressed a potential issue where the application could be exposed to Use-after-Free Remote Code Execution vulnerability and crash when traversing bookmark nodes in certain PDF files. This occurs due to stack overflow caused by the infinite loop as the application fails to handle the loop condition correctly (CVE-2021-34846).

ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read/Write or Null Pointer Dereference vulnerability and crash when parsing certain PDF files. This occurs due to the access violation in the array subscript when storing the offset value for the indirect object because the array size created based on the /Size entry whose value is smaller than the actual maximum indirect object number is not enough to accommodate the data.

xina1i
DoHyun Lee(l33d0hyun)
Milan Kyselica

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read Information Disclosure vulnerability and crash when processing certain arguments. This occurs due to the access of illegal memory as the application fails to restrict the access to an array outside its bounds when calling the util.scand function. (CVE-2021-38564)

Xinyu Wan, Yiwei Zhang and Wei You from Renmin University of China

Addressed potential issues where the application could be exposed to Use-after-Free Remote Code Execution vulnerability and crash when handling certain Javascripts or annotation objects. This occurs due to the use or access of memory, pointer, or object that has been freed without proper validation ( CVE-2021-21831, CVE-2021-21870, CVE-2021-34831, CVE-2021-34832, CVE-2021-34847, CVE-2021-34850, CVE-2021-34849, CVE-2021-34848).

Aleksandar Nikolic of Cisco Talos
Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute working with Trend Micro Zero Day Initiative
ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group working with Trend Micro Zero Day Initiative
Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Arbitrary File Write vulnerability when executing the submitForm function. Attackers could exploit this vulnerability to create arbitrary files in the local system and inject the uncontrolled contents.

Hou JingYi (@hjy79425575)

Addressed potential issues where the application could be exposed to Use-after-Free Remote Code Execution vulnerability and crash when handling the annotation objects in certain PDF files if the same Annotation dictionary is referenced in the page structures for different pages. This occurs as multiple annotation objects are associated to the same Annotation dictionary (CVE-2021-34852, CVE-2021-34834, CVE-2021-34835, CVE-2021-34851, CVE-2021-34836, CVE-2021-34837, CVE-2021-34838, CVE-2021-34839, CVE-2021-34840, CVE-2021-34841, CVE-2021-34833, CVE-2021-34842, CVE-2021-34843, CVE-2021-34844, CVE-2021-34845, CVE-2021-34853).

Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute working with Trend Micro Zero Day Initiative
Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Use-after-Free vulnerability and crash when handling certain events of form elements. This occurs due to the use of Field object that has been cleaned up after executing events using the event.target property (CVE-2021-21893).

Aleksandar Nikolic of Cisco Talos

Addressed a potential issue where the application could be exposed to Stack Overflow vulnerability and crash when parsing XML data with too many embedded nodes. This occurs as the recursion level exceeds the maximum recursion depth when parsing XML nodes using recursion.

Milan Kyselica

Addressed a potential issue where the application could be exposed to Use-after-Free Remote Code Execution vulnerability and crash when traversing bookmark nodes in certain PDF files. This occurs due to stack overflow caused by the infinite loop as the application fails to handle the loop condition correctly (CVE-2021-34846).

ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Null Pointer Reference Denial of Service vulnerability and crash. This is caused by memory corruption due to the lack of proper validation when handling certain PDF files whose dictionary entries are missing (CNVD-C-2021-95204).

China National Vulnerability Database

Addressed potential issues where the application could be exposed to Use-after-Free Remote Code Execution vulnerability and crash when handling certain Javascripts. This occurs due to the use or access of memory or object that has been freed without proper validation (CVE-2021-21831, CVE-2021-34832).

Aleksandar Nikolic of Cisco Talos
Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Use-after-Free vulnerability and crash when handling certain events of form elements. This occurs due to the use of Field object that has been cleaned up after executing events using the event.target property (CVE-2021-21893).

Aleksandar Nikolic of Cisco Talos

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read/Write vulnerability and crash when parsing certain PDF files. This occurs due to the access violation in the array subscript when storing the offset value for the indirect object because the array size created based on the /Size entry whose value is smaller than the actual maximum indirect object number is not enough to accommodate the data.

Milan Kyselica

Addressed a potential issue where the application could be exposed to Use-after-Free Remote Code Execution vulnerability and crash when traversing bookmark nodes in certain PDF files. This occurs due to stack overflow caused by the infinite loop as the application fails to handle the loop condition correctly (CVE-2021-34846).

ZhangJiaxing(@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Memory Corruption vulnerability and crash when exporting certain PDF files to other formats. This occurs due to the access violation, which could be exploited by attackers to execute remote code.

Ariele Caltabiano (kimiya)

Addressed potential issues where the application could be exposed to Denial of Service vulnerability and crash when handling certain XFA forms or link objects. This is caused by stack overflow as there are too many levels or dead loops during the recursive call of functions (CNVD-C-2020-186243/CNVD-C-2020-186246/CNVD-C-2020-186244/CNVD-C-2020-186248/CNVD-C-2020-186237).

China National Vulnerability Database
Xuwei Liu

Addressed potential issues where the application could be exposed to Denial of Service, Null Pointer Reference, Out-of-Bounds Read, Context Level Bypass, Type Confusion, or Buffer Overflow vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs during the implementation of certain functions in JavaScript due to the use of incorrect parameters or objects without proper validation (CNVD-C-2020-305224/CNVD-C-2020-305182/CNVD-C-2020-305095/EIP-2018-0045/CNVD-C-2020-305100/CVE-2021-31461/CVE-2021-31476).

Xinyu Wan, Yiwei Zhang, and Wei You from Renmin University of China
China National Vulnerability Database
mnhFly of Aurora Infinity WeiZhen Security Team
Exodus Intelligence
cor3sm4sh3r working with Volon Cyber Security Pvt Ltd working with
Trend Micro Zero Day Initiative
Yongil Lee(@intellee) and Wonyoung Jung(@nonetype) of Diffense
cece working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Arbitrary File Deletion vulnerability due to improper access control. Local attackers could exploit this vulnerability to create a symbolic link and cause arbitrary files to be deleted once the application is uninstalled by an admin user.

Dhiraj Mishra (@RandomDhiraj)

Addressed a potential issue where the application could deliver incorrect signature information for certain PDF files that contained invisible digital signatures. This occurs as the application gets the certificate name in an incorrect order and displays the document owner as the signature author by mistake.

Thore Hendrikson

Addressed potential issues where the application could be exposed to DLL Hijacking vulnerability when it was launched, which could be exploited by attackers to execute remote code by placing a malicious DLL in the specified path directory. This occurs due to the improper behavior while loading libraries, including loading the libraries in the installation directory as precedence when loading system libraries, loading the libraries that are disguised as system libraries in the installation folder without proper validation, and failing to use the fully qualified paths when loading external libraries (CNVD-C-2021-68000/CNVD-C-2021-68502).

mnhFly of Aurora Infinity WeiZhen Security Team
China National Vulnerability Database

Addressed potential issues where the application could be exposed to Out-of-Bounds Write/Read Remote Code Execution or Information Disclosure vulnerability and crash when handling certain JavaScripts or XFA forms. This occurs due to the use of abnormal data that exceeds the maximum size allocated in parameters without proper validation (CVE-2021-31452/CVE-2021-31473).

mnhFly of Aurora Infinity WeiZhen Security Team
Yongil Lee(@intellee) and Wonyoung Jung(@nonetype) of Diffense
Yongil Lee(@intellee) and Wonyoung Jung(@nonetype) of Diffense working with Trend Micro Zero Day Initiative
Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write vulnerability when parsing certain PDF files that contain nonstandard /Size key value in the Trailer dictionary. This occurs due to the access of an array whose size is not enough to accommodate the data.

xina1i

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write vulnerability and crash when converting certain PDF files to Microsoft Office files. This occurs as the PDF object data defined in the Cross-Reference Table is corrupted.

Haboob Lab

Addressed potential issues where the application could be exposed to Use-after-Free Remote Code Execution vulnerability and crash when handling certain XFA forms or annotation objects. This occurs due to the use or access of the objects that have been released or deleted (CVE-2021-31441/CVE-2021-31450/CVE-2021-31453/CVE-2021-31451/CVE-2021-31455/CVE-2021-31456/CVE-2021-31457/CVE-2021-31458/CVE-2021-31459/CVE-2021-31460/CVE-2021-21822).

Yongil Lee and Wonyoung Jung of Diffense
Xu Peng from UCAS and Wang Yanhao from QiAnXin Technology Research Institute working with Trend Micro Zero Day Initiative
Yongil Lee(@intellee) and Wonyoung Jung(@nonetype) of Diffense working with Trend Micro Zero Day Initiative
Aleksandar Nikolic of Cisco Talos

Addressed potential issues where the application could be exposed to Arbitrary File Write Remote Code Execution vulnerability when executing certain JavaScripts. This occurs as the application fails to restrict the file type and validate the file path in extractPages and CombineFiles functions (EIP-2018-0046/EIP-2019-0006/EIP-2019-0007).

Exodus Intelligence

Addressed potential issues where the application could be exposed to SQL Injection Remote Code Execution vulnerability. Attackers could exploit this vulnerability to insert or delete databases by inserting codes at the end of the strings (EIP-2018-0057/EIP-2018-0080/EIP-2018-0081).

Exodus Intelligence

Addressed a potential issue where the application could be exposed to Uninitialized Variable Information Disclosure vulnerability and crash. This occurs due to the array access violation resulting from the discrepant information in the form control when users press the Tab key to get focus on a field and input new text in certain XFA forms.

Yongil Lee and Wonyoung Jung of Diffense

Addressed potential issues where the application could be exposed to Out-of-Bounds Read or Heap-based Buffer Overflow vulnerability and crash, which could be exploited by attackers to execute remote code or disclose sensitive information. This occurs due to the logic error or improper handling of elements when working with certain PDF files that define excessively large value in the file attribute or contain negative leadDigits value in the file attribute (CVE-2021-31454).

Yongil Lee and Wonyoung Jung of Diffense
Yongil Lee(@intellee) and Wonyoung Jung(@nonetype) of Diffense working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read/Write, Use-After-Free, or Double Free vulnerability and crash if users were using 3D Plugin Beta, which could be exploited by attackers to execute remote code or disclose sensitive information. This occurs due to the lack of proper validation of illogical data range when handling certain U3D objects embedded in PDF files. (CVE-2021-31469/CVE-2021-31470/CVE-2021-31471/CVE-2021-31472/CVE-2021-31442/CVE-2021-31443/CVE-2021-31444/CVE-2021-31445/CVE-2021-31446/CVE-2021-31447/CVE-2021-31448/CVE-2021-31449/CVE-2021-31467/CVE-2021-31468/CVE-2021-31466/CVE-2021-31465/CVE-2021-31464/CVE-2021-31463/CVE-2021-31462).

Mat Powell of Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where remote attackers to execute arbitrary code on the application. This is caused by an uninitialized variable(CVE-2021-31435).

Francis Provencher {PRL} working with Trend Micro Zero Day Initiative

Addressed potential issues where remote attackers to execute arbitrary code on the application. There is a potential problem with overwriting buffers in the ARW, JPM, JP2 file's parser. (CVE-2021-31433/ CVE-2021-31434/ CVE-2021-31437).

Wenguang Jiao working with Trend Micro Zero Day Initiative
Francis Provencher {PRL} working with Trend Micro Zero Day Initiative

Addressed potential issues where remote attackers to execute arbitrary code on the application. There is a potential problem with overwriting buffers in the parser of the SGI file. (CVE-2021-31436).

Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where remote attackers to execute arbitrary code on the application. There is a potential problem with overwriting buffers in the parser of the PSP file. (CVE-2021-31438)

Francis Provencher {PRL} working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Fixed a cross-site scripting security where the JavaScript app.alert() message was taken as HTML code, injected into HTML DOM and execute.

Luigi Gubello

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read vulnerability and crash, which could be exploited by attackers to execute remote code. This occurs due to the improper release of resources when parsing certain JPEG2000 files (CVE-2021-27270).

cece working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read, Use-After-Free, or Memory Corruption vulnerability and crash if users were using 3D Plugin Beta, which could be exploited by attackers to execute remote code or disclose sensitive information. This occurs when working with certain PDF files that contain 3D objects due to a parse error as the data format recorded in the PDF file is not consistent with the actual one (CVE-2021-27261/CVE-2021-27262/CVE-2021-27263/CVE-2021-27264/CVE-2021-27265/CVE-2021-27266/CVE-2021-27267/CVE-2021-27268/CVE-2021-27271).

Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write vulnerability and crash if users were using 3D Plugin Beta, which could be exploited by attackers to execute remote code. This occurs when parsing certain PDF files that contain 3D objects as the number of KeyFrames defined in MOTIONRESOURCE (0xffffff56) block does not match the actual one written (CVE-2021-27269).

Mat Powell of Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Evil Annotation Attack and deliver incorrect validation results when validating certain certified PDF files whose visible content was significantly altered. This occurs as the application fails to identify the objects in the incremental update when the Subtype entry of the Annotation dictionary is set as null.

Simon Rohlmann, Vladislav Mladenov, Christian Mainka, Jorg Schwenk

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write Remote Code Execution vulnerability and crash while processing certain XFA templates. This occurs during the process of modifying control attributes and appending nodes as the application fails to validate and uses certain type of object that is explicitly converted from a wrong layout object created by the appended template node (CVE-2020-27860).

Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Evil Annotation Attack and deliver incorrect validation results when validating certain certified PDF files whose visible content was significantly altered. This occurs as the application fails to identify the objects in the incremental update when the Subtype entry of the Annotation dictionary is set as null.

Simon Rohlmann, Vladislav Mladenov, Christian Mainka, Jorg Schwenk

Addressed a potential issue where the application could be exposed to Type Confusion Memory Corruption or Remote Code Execution vulnerability and crash due to the lack of proper validation when an incorrect argument was passed to the app.media.openPlayer function defined in PDF JavaScript API (CVE-2020-13547).

Aleksandar Nikolic of Cisco Talos

Addressed potential issues where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when executing certain JavaScript in a PDF file. This occurs due to the access or use of pointer or object that has been removed after calling certain JavaScript functions (CVE-2020-13548/CVE-2020-13557/CVE-2020-13560/CVE-2020-13570).

Aleksandar Nikolic of Cisco Talos

Addressed a potential issue where the application could be exposed to Denial of Service vulnerability and crash when opening certain PDF files that contained illegal value in the /Size entry of the Trail dictionary. This occurs due to the array overflow as the illegal value in the /Size entry causes an error in initializing the array size for storing the compression object streams, and an object number which is larger than the initialization value is used as the array index while parsing the cross-reference streams (CVE-2020-28203).

Sanjeev Das (IBM Research)

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write Remote Code Execution vulnerability and crash while processing certain XFA templates. This occurs during the process of modifying control attributes and appending nodes as the application fails to validate and uses certain type of object that is explicitly converted from a wrong layout object created by the appended template node (CVE-2020-27860).

Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Evil Annotation Attack and deliver incorrect validation results when validating certain certified PDF files whose visible content was significantly altered. This occurs as the application fails to identify the objects in the incremental update when the Subtype entry of the Annotation dictionary is set as null.

Simon Rohlmann, Vladislav Mladenov, Christian Mainka, Jorg Schwenk

Addressed a potential issue where the application could be exposed to Type Confusion Memory Corruption or Remote Code Execution vulnerability and crash due to the lack of proper validation when an incorrect argument was passed to the app.media.openPlayer function defined in PDF JavaScript API (CVE-2020-13547).

Aleksandar Nikolic of Cisco Talos

Addressed potential issues where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when executing certain JavaScript in a PDF file. This occurs due to the access or use of pointer or object that has been removed after calling certain JavaScript functions (CVE-2020-13548/CVE-2020-13557/CVE-2020-13560/CVE-2020-13570).

Aleksandar Nikolic of Cisco Talos

Addressed a potential issue where the application could be exposed to Denial of Service vulnerability and crash when opening certain PDF files that contained illegal value in the /Size entry of the Trail dictionary. This occurs due to the array overflow as the illegal value in the /Size entry causes an error in initializing the array size for storing the compression object streams, and an object number which is larger than the initialization value is used as the array index while parsing the cross-reference streams (CVE-2020-28203).

Sanjeev Das (IBM Research)

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Use-After-Free vulnerability and crash when executing JavaScript in certain AcroForm. This occurs due to the use of Opt object after it has been deleted by calling Field::ClearItems method while executing Field::DeleteOptions method.

Hung Tien Tran @hungtt28

Addressed a potential issue where the application could be exposed to Write/Read Access Violation vulnerability and crash. This occurs due to the exception thrown by the V8 JavaScript engine, which is resulted from the failure to properly handle the situation where the Index returned during the allocation of thread local storage by TslAlloc function exceeds the limits acceptable by the V8 JavaScript engine.

John Stigerwalt

Addressed potential issues where the application could be exposed to Null Pointer Access/Dereference vulnerability and crash when opening certain specially crafted PDF. This occurs due to the access or reference of the null pointer without proper validation (CNVD-C-2020-169904/CNVD-C-2020-186241/CNVD-C-2020-186245).

John Stigerwalt
Nafiez, Fakhrie and Yeh of TomatoDuck Fuzzing Group
China National Vulnerability Database

Addressed a potential issue where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when parsing certain JPEG2000 images. This occurs because the application fails to release memory correctly based on the memory block information (CVE-2020-17410).

Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write vulnerability and crash. This occurs during the handling of Shading because the number of outputs calculated by function does not match the number of color components in the Shading directory’s color space.

Nafiez, Fakhrie and Yeh of TomatoDuck Fuzzing Group

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write Remote Code Execution vulnerability when parsing certain JPEG2000 images due to the incorrect read and write of memory at invalid address (CVE-2020-17416).

Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability during installation. This occurs as the application does not use the absolute path to find taskkill.exe but firstly finds and executes the one in the current working directory.

Dhiraj Mishra (@RandomDhiraj)

Addressed a potential issue where the application could be exposed to Use-After-Free Information Disclosure or Remote Code Execution vulnerability and crash. This occurs due to the use of /V item which is deleted after being interpreted as the action executed during validation when it exists in both Additional Action and Field dictionaries but shares different interpretations (CNVD-C-2020-169907).

China National Vulnerability Database

Addressed a potential issue where the application could be exposed to Universal Signature Forgery vulnerability and deliver incorrect validation results when validating digital signatures in certain PDF files. This occurs as the application fails to perform cryptographic validation of signatures correctly, which could be exploited by attackers to forge arbitrary signatures on arbitrary files and deceive the validator.

Matthias Valvekens

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read/Write or Stack-based Buffer Overflow vulnerability if users were using 3D Plugin Beta, which could be exploited by attackers to execute remote code or disclose sensitive information. This occurs due to the lack of proper validation of data when parsing certain U3D object that contains incorrect data stream (CNVD-C-2020-73515/CNVD-C-2020-73509/CVE-2020-17411/CVE-2020-17412/CVE-2020-17413).

China National Vulnerability Database
Mat Powell of Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Code Injection or Information Disclosure vulnerability because it did not enable Hardened Runtime capability during code signing.

Hou JingYi (@hjy79425575)

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Use-After-Free vulnerability and crash when executing JavaScript in certain AcroForm. This occurs due to the use of Opt object after it has been deleted by calling Field::ClearItems method while executing Field::DeleteOptions method.

Hung Tien Tran @hungtt28

Addressed a potential issue where the application could be exposed to Write/Read Access Violation vulnerability and crash. This occurs due to the exception thrown by the V8 JavaScript engine, which is resulted from the failure to properly handle the situation where the Index returned during the allocation of thread local storage by TslAlloc function exceeds the limits acceptable by the V8 JavaScript engine.

John Stigerwalt

Addressed potential issues where the application could be exposed to Null Pointer Access/Dereference vulnerability and crash when opening certain specially crafted PDF. This occurs due to the access or reference of the null pointer without proper validation (CNVD-C-2020-169904/CNVD-C-2020-186241/CNVD-C-2020-186245).

John Stigerwalt
Nafiez, Fakhrie and Yeh of TomatoDuck Fuzzing Group
China National Vulnerability Database

Addressed a potential issue where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when parsing certain JPEG2000 images. This occurs because the application fails to release memory correctly based on the memory block information (CVE-2020-17410).

Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Incorrect Permission Assignment Privilege Escalation vulnerability, which could be exploited by attackers to execute an arbitrary program. This occurs due to the incorrect permission set on a resource used by Foxit update service (CVE-2020-17414/CVE-2020-17415).

@Kharosx0 working with Trend Micro Zero Day Initiative
Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write vulnerability and crash. This occurs during the handling of Shading because the number of outputs calculated by function does not match the number of color components in the Shading directory’s color space.

Nafiez, Fakhrie and Yeh of TomatoDuck Fuzzing Group

Addressed a potential issue where the application could be exposed to Out-of-Bounds Write Remote Code Execution vulnerability when parsing certain JPEG2000 images due to the incorrect read and write of memory at invalid address (CVE-2020-17416).

Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Remote Code Execution vulnerability during installation. This occurs as the application does not use the absolute path to find taskkill.exe but firstly finds and executes the one in the current working directory.

Dhiraj Mishra (@RandomDhiraj)

Addressed a potential issue where the application could be exposed to Use-After-Free Information Disclosure or Remote Code Execution vulnerability and crash. This occurs due to the use of /V item which is deleted after being interpreted as the action executed during validation when it exists in both Additional Action and Field dictionaries but shares different interpretations (CNVD-C-2020-169907).

China National Vulnerability Database

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read Remote Code Execution vulnerability and crash due to the lack of proper validation of the input data when triggering Doc.getNthFieldName method (CVE-2020-17417).

Anonymous working with Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Universal Signature Forgery vulnerability and deliver incorrect validation results when validating digital signatures in certain PDF files. This occurs as the application fails to perform cryptographic validation of signatures correctly, which could be exploited by attackers to forge arbitrary signatures on arbitrary files and deceive the validator.

Matthias Valvekens

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Out-of-Bounds Read/Write or Stack-based Buffer Overflow vulnerability if users were using 3D Plugin Beta, which could be exploited by attackers to execute remote code or disclose sensitive information. This occurs due to the lack of proper validation of data when parsing certain U3D object that contains incorrect data stream (CNVD-C-2020-73515/CNVD-C-2020-73509/CVE-2020-17411/CVE-2020-17412/CVE-2020-17413).

China National Vulnerability Database
Mat Powell of Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Uninitialized Object Information Disclosure vulnerability and crash. This occurs as the application directly transforms the PDF Object as PDF Stream for further actions without proper validation when verifying the information in a crafted XObject (CVE-2020-11493).

Steven Seeley of Qihoo 360 Vulcan Team

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read Information Disclosure vulnerability and crash. This occurs due to the application mistakenly uses the index of the original text string to recognize links after the original text string is divided into two pieces during text string layout (CVE-2020-12247).

Steven Seeley of Qihoo 360 Vulcan Team

Addressed a potential issue where the application could be exposed to Use-After-Free Information Disclosure vulnerability and crash due to the access of illegal memory when loading certain webpage (CVE-2020-15637).

Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Heap Buffer Overflow Remote Code Execution vulnerability and crash. This occurs due to the application fails to execute a fault-tolerance mechanism when processing the dirty data in the image resources (CVE-2020-12248).

Steven Seeley of Qihoo 360 Vulcan Team

Addressed a potential issue where the application could be exposed to Type Confusion Remote Code Execution vulnerability and crash due to the access of array whose length is larger than its initial length (CVE-2020-15638).

Rene Freingruber (@ReneFreingruber) and Patrick Wollgast working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Uninitialized Object Information Disclosure vulnerability and crash. This occurs as the application directly transforms the PDF Object as PDF Stream for further actions without proper validation when verifying the information in a crafted XObject (CVE-2020-11493).

Steven Seeley of Qihoo 360 Vulcan Team

Addressed a potential issue where the application could be exposed to Out-of-Bounds Read Information Disclosure vulnerability and crash. This occurs due to the application mistakenly uses the index of the original text string to recognize links after the original text string is divided into two pieces during text string layout (CVE-2020-12247).

Steven Seeley of Qihoo 360 Vulcan Team

Addressed a potential issue where the application could be exposed to Use-After-Free Information Disclosure vulnerability and crash due to the access of illegal memory when loading certain webpage (CVE-2020-15637).

Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Heap Buffer Overflow Remote Code Execution vulnerability and crash. This occurs due to the application fails to execute a fault-tolerance mechanism when processing the dirty data in the image resources (CVE-2020-12248).

Steven Seeley of Qihoo 360 Vulcan Team

Addressed a potential issue where the application could be exposed to Type Confusion Remote Code Execution vulnerability and crash due to the access of array whose length is larger than its initial length (CVE-2020-15638).

Rene Freingruber (@ReneFreingruber) and Patrick Wollgast working with Trend Micro Zero Day Initiative

Brief

Acknowledgement

Addressed a potential issue where the application could be exposed to Signature Validation Bypass vulnerability and deliver incorrect validation result when validating certain PDF file that is modified maliciously or contains non-standard signatures (CVE-2020-9592/CVE-2020-9596).

Christian Mainka, Vladislav Mladenov, Simon Rohlmann, Jorg Schwenk

Brief

Acknowledgement

Addressed potential issues where the application could be exposed to Type Confusion or Arbitrary File Write Remote Code Execution vulnerability and crash. This occurs during the handling of app.opencPDFWebPage JavaScript due to the lack of proper validation of parameters in socket message (ZDI-CAN-9828/ZDI-CAN-9829/ZDI-CAN-9830/ZDI-CAN-9831/ZDI-CAN-9865/ZDI-CAN-9942/ZDI-CAN-9943/ZDI-CAN-9944/ZDI-CAN-9945/ZDI-CAN-9946)

Anonymous working with Trend Micro Zero Day Initiative
Mat Powell of Trend Micro Zero Day Initiative

Addressed a potential issue where the application could be exposed to Information Disclosure vulnerability if users were using the DocuSign plugin. This occurs because the username and password are hardcoded in the DocuSign plugin during an HTTP request.

David Cook

Addressed a potential issue where the application could be exposed to Brute-force Attack vulnerability as the CAS service did not limit the times of user login failures.

Hassan Personal

Addressed potential issues where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when processing certain XFA template or AcroForm due to the use of objects which had been freed (ZDI-CAN-10132/ZDI-CAN-10142/ZDI-CAN-10614/ZDI-CAN-10650).