Vulnerability in popular PDF reader could lead to arbitrary code execution; Multiple issues in GNOME project
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-28888 | A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. NVD description · AI analysis pending | 8.8 | 2% | PoC |
| — | |
| CVE-2024-42415 +1 in the same advisory: …36474 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2024-41163 | Unauthenticated directory traversal in Veertu Anka Build 1.42.0 Veertu Anka Build version 1.42.0 contains a directory traversal vulnerability (CWE-22) in its archive functionality. An unauthenticated, remote attacker can send a specially crafted HTTP request to the Anka Build Cloud service that traverses outside the intended directory. Successful exploitation results in disclosure of sensitive information, effectively reading files outside the intended archive path, with high confidentiality impact but no integrity or availability impact per the CVSS 7.5 score. Any organization running Veertu Anka Build 1.42.0, typically deployed as private CI/CD infrastructure for macOS/iOS builds, is affected. A public proof-of-concept is available via Cisco Talos (TALOS-2024-2059), the issue is not yet in CISA KEV, and EPSS assigns a 52.5% probability of exploitation within 30 days (99th percentile), so defenders should treat exploitation risk as elevated. Do: Upgrade Anka Build to a release newer than 1.42.0 following Veertu's guidance for TALOS-2024-2059 / CVE-2024-41163, as no fixed version number is specified in the available data. Until upgraded, restrict network access to the Anka Build Cloud controller API to trusted hosts, since the flaw is triggered by an unauthenticated HTTP request. Review controller logs for suspicious requests to the archive endpoint and for evidence that sensitive files were retrieved. | 7.5 group max | 52% | PoC |
| nichelikely hundreds to low thousands of Anka Build Cloud deployments worldwide (mostly internal CI/CD infrastructure) |
Full article430 words · extracted from blog.talosintelligence.com · click to collapse
Wednesday, October 9, 2024 12:00
Cisco Talos’ Vulnerability Research team recently disclosed six new security vulnerabilities across a range of software, including one in a popular PDF reader that could lead to arbitrary code execution.
Foxit PDF Reader, one of the most popular alternatives to Adobe Acrobat, contains a memory corruption vulnerability that could allow an adversary to execute code on the targeted machine.
Talos also discovered three vulnerabilities in Veertu’s Anka Build, a suite of software designed to test macOS or iOS applications in CI/CD environments.
For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website.
Use-after-free vulnerability in Foxit PDF Reader
Discovered by KPC.
A use-after-free vulnerability in Foxit PDF Reader could lead to memory corruption and eventually arbitrary code execution on the targeted machine.
TALOS-2024-1967 (CVE-2024-28888) can be triggered if an adversary tricks a user into opening a specially crafted PDF that contains malicious JavaScript. Exploitation could also occur if the targeted user visits an attacker-controlled website with the Foxit PDF Reader browser extension enabled.
Multiple vulnerabilities in GNOME project library could lead to code execution
Two vulnerabilities in the G Structured File Library (libgsf) could lead to arbitrary code execution.
This GNOME project supports an abstraction layer around different structure file formats such as .tar and .zip.
TALOS-2024-2068 (CVE-2024-36474) is an integer overflow vulnerability that could allow an out-of-bounds index to be used when reading and writing to an array. This could lead to arbitrary code execution if an adversary exploited it appropriately.
TALOS-2024-2069 (CVE-2024-42415) works similarly, but in this case, it arises when the software processes the sector allocation table.
An adversary could exploit both these vulnerabilities by tricking the targeted user into opening a malicious, specially crafted file.
Three vulnerabilities in Veertu Anka Build
Discovered by KPC.
Veertu’s Anka Build software contains three vulnerabilities, two of which are directory traversal issues.
Anka Build is a suite of software designed to test macOS and iOS applications in CI/CD environments. The suite is a centralized dashboard for managing nodes, VM instances, templates, tags and logs.
This software contains two directory traversal vulnerabilities — TALOS-2024-2059 (CVE-2024-41163) and TALOS-2024-2061 (CVE-2024-41922) — that could lead to the disclosure of arbitrary files. An adversary could exploit these vulnerabilities by sending the target a specially crafted HTTP request.
Another vulnerability, TALOS-2024-2060 (CVE-2024-39755), is a privilege escalation issue that could allow a low-privileged user to force the software to update, potentially raising their access to that of a root user.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/vulnerability-roundup-foxit-gnome-oct-9-2024/