Nitro Pro 13.13.2.242 Rendering Engine integer overflow

Summaryinfo

A vulnerability classified as critical has been found in Nitro Pro 13.13.2.242. The impacted element is an unknown function of the component Rendering Engine. The manipulation leads to integer overflow. This vulnerability is documented as CVE-2020-6116. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in Nitro Pro 13.13.2.242. It has been rated as critical. This issue affects some unknown processing of the component Rendering Engine. The manipulation with an unknown input leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a page using colors from an indexed colorspace, the application can miscalculate the size of a buffer when allocating space for its colors. When using this allocated buffer, the application can write outside its bounds and cause memory corruption which can lead to code execution. A specially crafted document must be loaded by a victim in order to trigger this vulnerability.

The weakness was released 09/17/2020 (Website). It is possible to read the advisory at talosintelligence.com. The identification of this vulnerability is CVE-2020-6116 since 01/07/2020. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-161530, VDB-161529 and VDB-161528. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Nitro Pro

Version

• 13.13.2.242

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion