Security Updates for Foxit, Quick Time/iTunes
Summary: Foxit Software released an update to its PDF reader, version 3.2.1.0401, that adds a warning when a PDF document tries to launch an embedded program, after researcher Didier Stevens showed that Foxit executed embedded executables without any warning or user approval. Apple also shipped QuickTime 7.6.6, fixing at least 16 security flaws on Mac and Windows, and iTunes 9.1, addressing at least seven security holes.
What's compelling: Stevens said his proof-of-concept code still worked against the updated Foxit Reader, so the warning alone did not close the attack path that lets a malformed PDF run executable code on a Windows PC.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026