PT-2020-19580 · Documalis · Documalis Free Pdf Editor+1

Metacom27 · Published 2020-08-12 · Updated 2020-08-19 · CVE-2020-7374

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Documalis Free PDF Editor version 5.7.2.26 Documalis Free PDF Scanner version 5.7.2.122

Description The issue arises from the improper validation of JPEG images within PDFs, which can be exploited to trigger a buffer overflow on the stack. This can lead to remote code execution with the privileges of the user running the software.

Recommendations For Documalis Free PDF Editor version 5.7.2.26, update to a version that properly validates the contents of JPEG images to prevent buffer overflow attacks. For Documalis Free PDF Scanner version 5.7.2.122, update to a version that correctly handles JPEG images within PDFs to mitigate the risk of remote code execution.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-7374

Affected Products

Documalis Free Pdf Editor

Documalis Free Pdf Scanner

References · 3

• 🔥 https://github.com/rapid7/metasploit-framework/pull/13517 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7374 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7374 · Vendor Advisory