PDFex Vulnerability

[Unregistered]

Are any Tracker Software products susceptible to the PDFex vulnerabilities?

https://pdf-insecurity.org/encryption/encryption.html

https://www.forbes.com/sites/zakdoffman ... -apps-now/

[Will - Tracker Supp]

Hi Unregistered,

Thanks for the post - This was a vulnerability but was fixed as of build 332. The latest release is build 333:
https://www.pdf-xchange.com/downloads

Cheers,

[Unregistered]

I'd appreciate if this sort of thing would be mentioned in the release notes in the future. I've been using PDF Tools build 330 and skipped later updates because none of them seemed applicable or important to me. This important security fix is not mentioned.

https://www.pdf-xchange.com/produc ... #8.0.333.0

Thanks.

[Ivan - Tracker Software]

PDF Tools were not affected. In build history for the Editor, we mentioned this fix, but we were not allowed to provide more details about the vulnerability at that moment.

[Unregistered]

But PDF Tools installs the viewer/editor by default, doesn't it? So a user would have to go out of his or her way to look at release notes for products they're not directly installing to know about this.

No details were necessary, just mention of a fix for a security vulnerability would suffice.

[Tracker Supp-Stefan]

Hello Unregistered,

The fix was effectively in the Editor, and did apply to the version of the Editor that comes with Tools, so yes the fix was included in Tools as well, but as it was not explicitly applied to Tools - we missed adding it in the version history.
I will see if we can make sure that in future similar cases we mention security related fixes in the version history pages of all our products!

Regards,
Stefan