CVE-2020-6112

An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes in the tile which...

CVE-2020-6113

An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for...

CVE-2020-6113

Nitro Pro ( Nitro Pro 13.13.2.242; and affected builds per TALOS include 13.16.2.300) contains an exploitable vulnerability in object stream parsing during cross-reference table updates. The root cause is an integer overflow when computing memory size for the list of indirect objects, which can a...

CVE-2020-6112

An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes in the tile which...

CVE-2020-6112

Summary: CVE-2020-6112 is a memory corruption/remote code execution risk in Nitro Pro’s JPEG2000 Stripe Decoding (JPXDecode) path. The root cause is a miscalculation of a pointer while decoding sub-samples in a tile, enabling writes out of bounds to a buffer allocated for stripe decoding. This ca...

CVE-2020-6115

An exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. While searching for an object identifier in a malformed document that is missing from the cross-reference table, the application will save a reference to the...

CVE-2020-6115

Nitro CVE-2020-6115 affects Nitro Pro (notably 13.13.2.242 and 13.16.2.300). The root cause is a use-after-free triggered by a cross-reference (xref) table repair when a crafted PDF omits an object referenced by a trailer-controlled xref. During parsing, Nitro may resize the cross-reference table...

CVE-2020-6116

An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a page using colors from an indexed colorspace, the application can miscalculate the size of a buffer when allocating space for its colors...

CVE-2020-6116

Nitro Pro 13.13.2.242 is affected by an Indexed ColorSpace rendering vulnerability (CVE-2020-6116). The root cause is an integer overflow when computing the indexed palette size for colors in an Indexed colorspace, leading to an undersized malloc and a heap-based buffer overflow during palette po...

Threat Source newsletter for Sept. 17, 2020

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We’ve got a couple of vulnerabilities you should know about. Monday, we disclosed a bug in Google Chrome’s PDFium feature that opens the door for an adversary to execute remote code. Our researchers also discovered several...

Nitro Software Nitro Pro Remote Code Execution Vulnerability

Nitro Software Nitro Pro is a U.S. Nitro Software PDF document editor software. The software supports PDF document editing, PDF document formatting and encryption of PDF documents and other functions. A remote code execution vulnerability exists in Nitro Pro version 13.13.2.242. The vulnerability...

Nitro Software Nitro Pro Arbitrary Code Execution Vulnerability

Nitro Software Nitro Pro is a U.S. Nitro Software PDF document editor software. The software supports PDF document editing, PDF document formatting and encryption of PDF documents and other functions. An arbitrary code execution vulnerability exists in Nitro Pro version 13.13.2.242, which arises...

Nitro Software Nitro Pro Input Validation Error Vulnerability (CNVD-2020-52634)

Nitro Software Nitro Pro is a U.S. Nitro Software PDF document editor software. The software supports PDF document editing, PDF document formatting and encryption of PDF documents and other functions. An input validation error vulnerability exists in Nitro Pro version 13.13.2.242, which stems fro...

Nitro Software Nitro Pro Buffer Overflow Vulnerability

Nitro Software Nitro Pro is a U.S. Nitro Software PDF document editor software. The software supports PDF document editing, PDF document formatting and encryption of PDF documents and other functions. A buffer overflow vulnerability exists in Nitro Pro versions 13.13.2.242 and 13.16.2.300. The...

PT-2020-18926

Name of the Vulnerable Software and Affected Versions Nitro Pro version 13.13.2.242 Description A code execution issue exists in the JPEG2000 Stripe Decoding functionality when decoding sub-samples. The application can miscalculate a pointer for the stripes in the tile, allowing the decoder to...

PT-2020-18929

Name of the Vulnerable Software and Affected Versions Nitro Pro version 13.13.2.242 Description A vulnerability exists in the cross-reference table repairing functionality. When searching for an object identifier in a malformed document, the application saves a reference to the object's...

PT-2020-18927

Name of the Vulnerable Software and Affected Versions Nitro Pro version 13.13.2.242 Description The issue exists in the object stream parsing functionality when updating its cross-reference table. It occurs due to an error in calculating the size for allocating memory for indirect objects, which...

PT-2020-18930

Name of the Vulnerable Software and Affected Versions Nitro Pro version 13.13.2.242 Description An issue exists in the rendering functionality of Nitro Pro. When drawing page contents using colors from an indexed colorspace, the application can miscalculate a buffer size, leading to memory...

CVE-2020-6112: Use of Out-of-range Pointer Offset

An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sub-samples. While initializing tiles with sub-sample data, the application can miscalculate a pointer for the stripes in the tile which...

CVE-2020-6116: Integer Overflow to Buffer Overflow

An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a page using colors from an indexed colorspace, the application can miscalculate the size of a buffer when allocating space for its colors...