CVE-2020-7374 Documalis Free PDF Editor / Free PDF Scanner Stack Based Buffer Overflow
Attackers can achieve remote code execution by tricking users into opening malicious PDFs with vulnerable Documalis software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-7374?
CVE-2020-7374 is a medium-severity memory corruption vulnerability in Documalis Free PDF Editor, published on 12 Aug 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.
Weakness: CWE-120
Which versions are affected by CVE-2020-7374?
It affects 2 products.
Products include Documalis Free Pdf Editor, Documalis Free Pdf Scanner.
How do I fix CVE-2020-7374?
No fix has been published for CVE-2020-7374 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-7374 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-7374 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-c62g-h8p8-p75m.