CVE-2018-18689
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-18689?
CVE-2018-18689 is a Signature Wrapping vulnerability in multiple PDF products.
Which software products are affected by CVE-2018-18689?
The affected software products include Avanquest Expert Pdf Ultimate, Avanquest Pdf Experte Ultimate, Foxitsoftware Foxit Reader, Gonitro Nitro Pro, Iskysoft Pdf Editor 6, Iskysoft Pdfelement6, pdfforge PDF Architect, Qoppa Pdf Studio, Qoppa Pdf Studio Viewer 2018, Sodapdf Soda Pdf, Sodapdf Soda Pdf Desktop, Soft-xpansion Perfect Pdf 10, Soft-xpansion Perfect Pdf Reader, Tracker-software Pdf-xchange Editor, Tracker-software Pdf-xchange Viewer, and Visagesoft Expert Pdf Reader.
What is the severity of CVE-2018-18689?
CVE-2018-18689 has a severity of 5.3, which is considered medium.
How does CVE-2018-18689 work?
CVE-2018-18689 exploits the lack of information in the PDF specification regarding signature validation, allowing attackers to use /ByteRange and xref manipulations.
Are Microsoft Windows, Apple macOS, and Linux Linux kernel vulnerable to CVE-2018-18689?
No, Microsoft Windows, Apple macOS, and Linux Linux kernel are not vulnerable to CVE-2018-18689.
How can I find more information about CVE-2018-18689?
You can find more information about CVE-2018-18689 at the following references: [Link 1](https://pdf-insecurity.org/signature/evaluation_2018.html), [Link 2](https://pdf-insecurity.org/signature/signature.html), [Link 3](https://www.foxitsoftware.com/support/security-bulletins.php).