PT-2020-18930 · Nitro · Nitro Pro

Published 2020-09-17 · Updated 2022-05-12 · CVE-2020-6116

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nitro Pro version 13.13.2.242

Description An issue exists in the rendering functionality of Nitro Pro. When drawing page contents using colors from an indexed colorspace, the application can miscalculate a buffer size, leading to memory corruption and potentially allowing code execution. This can be triggered by loading a specially crafted document.

Recommendations For Nitro Pro version 13.13.2.242, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

CWE-680

CWE-131

Related Identifiers

CVE-2020-6116

Affected Products

Nitro Pro

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1070 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-6116 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6116 · Vendor Advisory