CVE-2023-38105: 
Foxit PDF Reader vulnerability analysis and mitigation

Foxit PDF Reader contains an information disclosure vulnerability (CVE-2023-38105) that affects the parsing of PDF files. The vulnerability was discovered and disclosed in May 2023, with a coordinated public release on July 26, 2023. This security flaw impacts installations of Foxit PDF Reader and requires user interaction to be exploited, specifically requiring the target to visit a malicious page or open a malicious file (Zero Day Initiative).

The vulnerability stems from the lack of proper validation of user-supplied data during PDF file parsing, which can result in an out-of-bounds read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.0 base score of 3.3 (Low) with the vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating local access, low attack complexity, no privileges required, and user interaction required (Zero Day Initiative).

When exploited, this vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. The vulnerability could potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (Zero Day Initiative).

The vulnerability requires user interaction to be exploited, specifically requiring the target to visit a malicious page or open a malicious file. The attack complexity is considered low, but local access is required for exploitation (Zero Day Initiative).

Foxit has released security updates to address this vulnerability. Users are advised to update their Foxit PDF Reader installations to the latest version. The fix is available through the official security bulletin (Foxit Security Bulletin).