Vulnerability Description
An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a page using colors from an indexed colorspace, the application can miscalculate the size of a buffer when allocating space for its colors. When using this allocated buffer, the application can write outside its bounds and cause memory corruption which can lead to code execution. A specially crafted document must be loaded by a victim in order to trigger this vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gonitro | Nitro Pro | 13.13.2.242 |
Related Weaknesses (CWE)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1070ExploitThird Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1070ExploitThird Party Advisory
FAQ
What is CVE-2020-6116?
CVE-2020-6116 is a vulnerability with a CVSS score of 7.8 (HIGH). An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a page using colors from an indexed colors...
How severe is CVE-2020-6116?
CVE-2020-6116 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-6116?
Check the references section above for vendor advisories and patch information. Affected products include: Gonitro Nitro Pro.