Foxit Reader 9.7.2.29539

What's new in this version:

Security updates:
- Addressed potential issues where the application could be exposed to Type Confusion or Arbitrary File Write Remote Code Execution vulnerability and crash. This occurs during the handling of app.opencPDFWebPage JavaScript due to the lack of proper validation of parameters in socket message (ZDI-CAN-9828/ZDI-CAN-9829/ZDI-CAN-9830/ZDI-CAN-9831/ZDI-CAN-9865/ZDI-CAN-9942/ZDI-CAN-9943/ZDI-CAN-9944/ZDI-CAN-9945/ZDI-CAN-9946)
- Addressed a potential issue where the application could be exposed to Information Disclosure vulnerability if users were using the DocuSign plugin. This occurs because the username and password are hardcoded in the DocuSign plugin during an HTTP request.
- Addressed a potential issue where the application could be exposed to Brute-force Attack vulnerability as the CAS service did not limit the times of user login failures.
- Addressed potential issues where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when processing certain XFA template or AcroForm due to the use of objects which had been freed (ZDI-CAN-10132/ZDI-CAN-10142/ZDI-CAN-10614/ZDI-CAN-10650).
- Addressed a potential issue where the application could be exposed to Use-After-Free Remote Code Execution vulnerability and crash when working with certain malicious PDF file. This occurs as the application continues to execute JavaScript to open a document without proper validation after the page is deleted or the document is closed.
- Addressed potential issues where the application could be exposed to Circular Reference vulnerability and got stuck in a dead loop when working with certain PDF file. This occurs due to the lack of a circular reference verification mechanism when processing actions that contain circular reference.
- Addressed a potential issue where the application could be exposed to Infinite Loop or Out-of-Memory vulnerability and crash when parsing certain PDF file that contains irregular data in cross-reference stream or lengthy character strings in the content stream.
- Addressed a potential issue where the application could be exposed to Signature Validation Bypass vulnerability and deliver incorrect validation result when validating certain PDF file that is modified maliciously or contains non-standard signatures.