CVE-2018-1179

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DataSubBlock structures in GIF images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5490.

• CWE-125
• CWE-125

• https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-317Third Party Advisory, VDB Entry
• https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-317Third Party Advisory, VDB Entry

Published

May 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-11784When the default servlet in Apache Tomcat versions 9.0.0.M1 …
• CVE-2018-11785Missing authorization check in Apache Impala before 3.0.1 al…
• CVE-2018-11786In Apache Karaf prior to 4.2.0 release, if the sshd service …
• CVE-2018-11787In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when t…
• CVE-2018-11788Apache Karaf provides a features deployer, which allows user…
• CVE-2018-11789When accessing the heron-ui webpage, people can modify the f…
• CVE-2018-11790When loading a document with Apache Open Office 4.1.5 and ea…
• CVE-2018-11791Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-11792In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME requi…
• CVE-2018-11793When parsing a JSON payload with deeply nested JSON structur…
• CVE-2018-11794Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-11795Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…