CVE-2020-6113
HighAn exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table.
Published Sep 17, 2020 · Updated Nov 21, 2024
Key Facts
Patch immediately- CVE-2020-6113 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Nitro Pro (Gonitro).
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 64% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
64%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-6113 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for the list of indirect objects. Due to an error when calculating this size, an integer overflow may occur which can result in an undersized buffer being allocated. Later when initializing this buffer, the application can write outside its bounds which can cause a memory corruption that can lead to code execution. A specially crafted document can be delivered to a victim in order to trigger this vulnerability.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Nitro ProGonitro | 13.13.2.242, 13.16.2.300, >= Nitro Pro 13.13.2.242, Nitro Pro 13.16.2.300 | n/a |
Timeline
Publicly disclosed
Sep 17, 2020
Last updated
Nov 21, 2024
Weakness Type
- CWE-131 Incorrect Calculation of Buffer Size
- CWE-190 Integer Overflow or Wraparound
- CWE-787 Out-of-bounds Write
References
FAQ
Common Questions.
An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table.
Affected: Nitro Pro (Gonitro) versions 13.13.2.242, 13.16.2.300, >= Nitro Pro 13.13.2.242, Nitro Pro 13.16.2.300. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-6113 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo