CVE-2020-6116

An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a page using colors from an indexed colorspace, the application can miscalculate the size of a buffer when allocating space for its colors. When using this allocated buffer, the application can write outside its bounds and cause memory corruption which can lead to code execution. A specially crafted document must be loaded by a victim in order to trigger this vulnerability.
References
Link Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1070 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gonitro:nitro_pro:13.13.2.242:*:*:*:*:*:*:*
cpe:2.3:a:gonitro:nitro_pro:13.16.2.300:*:*:*:*:*:*:*

History

19 Apr 2022, 16:15

Type Values Removed Values Added
CWE CWE-787
CWE-131

Information

Published : 2020-09-17 13:15

Updated : 2024-02-04 21:00


NVD link : CVE-2020-6116

Mitre link : CVE-2020-6116

CVE.ORG link : CVE-2020-6116


JSON object : View

Products Affected

gonitro

  • nitro_pro
CWE
CWE-131

Incorrect Calculation of Buffer Size

CWE-190

Integer Overflow or Wraparound

CWE-787

Out-of-bounds Write

CWE-680

Integer Overflow to Buffer Overflow