7.8high
CVE-2016-8856
Foxit Reader for Mac 2.1.0.0804 and earlier and Foxit Reader for Linux 2.1.0.0805 and earlier suffered from a vulnerability where weak file…
Published 10 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 58%
Public exploits
0
none known
Summary
Foxit Reader for Mac 2.1.0.0804 and earlier and Foxit Reader for Linux 2.1.0.0805 and earlier suffered from a vulnerability where weak file permissions could be exploited by attackers to execute arbitrary code. After the installation, Foxit Reader's core files were world-writable by default, allowing an attacker to overwrite them with backdoor code, which when executed by privileged user would result in Privilege Escalation, Code Execution, or both.
Exploit prediction (EPSS)
0.82% probability of exploitation in the next 30 days, higher than 58% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-275 Permission Issues
References
- securityfocus.com /bid/93608 · vdb-entry, x_refsource_BID, x_transferred
- foxitsoftware.com /support/security-bulletins.php · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1037101 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2016-8856
- NVD: CVE-2016-8856
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.