Vulnerability Description
An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes in the tile which allow for the decoder to write out of-bounds and cause memory corruption. This can result in code execution. A specially crafted image can be embedded inside a PDF and loaded by a victim in order to trigger this vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gonitro | Nitro Pro | 13.13.2.242 |
Related Weaknesses (CWE)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1062ExploitThird Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1062ExploitThird Party Advisory
FAQ
What is CVE-2020-6112?
CVE-2020-6112 is a vulnerability with a CVSS score of 7.8 (HIGH). An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles wit...
How severe is CVE-2020-6112?
CVE-2020-6112 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-6112?
Check the references section above for vendor advisories and patch information. Affected products include: Gonitro Nitro Pro.