Strix
26.1K

CVE-2020-6113

HIGHCVSS 7.8/10EPSS 68.62%

Last modified

CVE-2020-6113 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for the list of indirect objects. EPSS estimates a 68.62% chance of exploitation in the next 30 days.

Description

An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for the list of indirect objects. Due to an error when calculating this size, an integer overflow may occur which can result in an undersized buffer being allocated. Later when initializing this buffer, the application can write outside its bounds which can cause a memory corruption that can lead to code execution. A specially crafted document can be delivered to a victim in order to trigger this vulnerability.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
68.62%

99.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GonitroNitro Pro13.13.2.242
GonitroNitro Pro13.16.2.300

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-6113?
An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for the list of indirect objects. Due to an error when calculating this size, an integer overflow may occur which can result in an undersized buffer being allocated. Later when initializing this buffer, the application can write outside its bounds which can cause a memory corruption that can lead to code execution. A specially crafted document can be delivered to a victim in order to trigger this vulnerability.
How severe is CVE-2020-6113?
CVE-2020-6113 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 68.62% probability of exploitation in the next 30 days.
How do I fix CVE-2020-6113?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-6113?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST