Incorrect PDF Signature Handling in Foxit Reader and PhantomPDF
CVE-2021-33795

5.5MEDIUM

Key Information:

Vendor
Foxit
Status
Foxit Reader
PhantomPDF
Vendor
CVE Published:
9 July 2021

Summary

Foxit Reader and PhantomPDF prior to version 10.1.4 exhibit a vulnerability that compromises the integrity of PDF document signatures. This issue arises from incorrect handling of critical data elements such as the certificate name, document owner, and signature author, leading to the potential for misleading or invalid signatures. Users are advised to update to the latest version to mitigate risks associated with this vulnerability.

References

https://www.foxitsoftware.com/support/security-bulletins....
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.