########################################################################################
# Title: PDF-XChange Viewer - Shading Type 7 Heap Memory Corruption
# Application: PDF-XChange Viewer
# Version 2.5.315.0
# Platform: Windows
# Software Link: http://www.tracker-software.com/
# Date: 2015-11-15
# Author: Sébastien Morin from COSIG
# Contact: https://twitter.com/COSIG_ (@COSIG_)
# Personal contact: https://twitter.com/SebMorin1 (@SebMorin1)
########################################################################################
===================
Introduction:
===================
PDF-XChange Viewer is a proprietary PDF reader for Microsoft Windows available for free. The basic reader, which can be downloaded free of charge, includes extended/markup capabilities such as typing, highlighting, callouts, and notes. Another useful feature is its ability to display PDF files in the "preview" pane of the Windows Explorer without locking the file (and thus allowing for easy setting of metadata info). An advanced paid version is also available.
(https://en.wikipedia.org/wiki/PDF-XChange_Viewer)
########################################################################################
===================
Report Timeline:
===================
2015-11-15 Sébastien Morin from COSIG found the vulnerability;
2015-11-16 Sébastien Morin from COSIG report the vulnerability to vendor;
2015-11-16 Vendor fixed the issue;
2016-01-18 Vendor released fixed version of PDF-XChange Viewer (version 2.5.316.1)
2016-01-18 Advisory Release
########################################################################################
===================
Technical details:
===================
A heap memory corruption occurs when PDF-XChange Viewer handle a invalid Shading Type 7 stream.
An attacker can leverage this vulnerability to potentially execute arbitrary code on vulnerable installations of PDF-XChange Viewer.
########################################################################################
==========
POC:
==========
https://smsecurity.net/pdf-xchange-viewer-shading-type-7-heap-memory-corruption/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39275.zip
########################################################################################
