CVE-2020-6113 Integer overflow in Nitro Pro
A crafted PDF document can trigger an integer overflow in Nitro Pro, leading to memory corruption and arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-6113?
CVE-2020-6113 is a high-severity vulnerability in Nitro Pro, published on 17 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for the list of indirect objects. Due to an error when calculating this size, an integer overflow may occur which can result in an undersized buffer being allocated. Later when initializing this buffer, the application can write outside its bounds which can cause a memory corruption that can lead to code execution. A specially crafted document can be delivered to a victim in order to trigger this vulnerability.
Which versions are affected by CVE-2020-6113?
It affects 1 product.
Products include Gonitro Nitro Pro.
How do I fix CVE-2020-6113?
No fix has been published for CVE-2020-6113 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-6113 being exploited?
There is no known exploitation of CVE-2020-6113 in the wild and no public exploit code.
Other vulnerabilities in Nitro Pro
Sources
Also known as GHSA-qrv7-h49g-2qfw.