CVE-2020-6115

{"id": "CVE-2020-6115", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-09-17T13:15:16.197", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1068", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1068", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-416"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "An exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.\u2019s Nitro Pro 13.13.2.242. While searching for an object identifier in a malformed document that is missing from the cross-reference table, the application will save a reference to the object\u2019s cross-reference table entry inside a stack variable. If the referenced object identifier is not found, the application may resize the cross-reference table which can change the scope of its entry. Later when the application tries to reference cross-reference entry via the stack variable, the application will access memory belonging to the recently freed table causing a use-after-free condition. A specially crafted document can be delivered by an attacker and loaded by a victim in order to trigger this vulnerability."}, {"lang": "es", "value": "Se presenta una vulnerabilidad explotable en la funcionalidad cross-reference table repairing de Nitro Pro de Nitro Software, Inc versi\u00f3n 13.13.2.242. Mientras busca un identificador de objeto en un documento malformado que se encuentra en la tabla de referencias cruzadas, la aplicaci\u00f3n guardar\u00e1 una referencia a la entrada de la tabla de referencias cruzadas del objeto dentro de una variable de pila. Si no se encuentra el identificador del objeto al que se hace referencia, la aplicaci\u00f3n puede cambiar el tama\u00f1o de la tabla de referencias cruzadas, lo que puede cambiar el alcance de su entrada. M\u00e1s tarde, cuando la aplicaci\u00f3n intenta hacer referencia a una entrada de referencia cruzada por medio de la variable de pila, la aplicaci\u00f3n acceder\u00e1 a la memoria que pertenece a la tabla liberada recientemente, causando una condici\u00f3n de uso de la memoria previamente liberada. Un atacante puede entregar un documento especialmente dise\u00f1ado y cargado por una v\u00edctima para desencadenar esta vulnerabilidad"}], "lastModified": "2024-11-21T05:35:08.333", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gonitro:nitro_pro:13.13.2.242:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0B9A6A1-1800-405F-8435-15AFD4FD1801"}, {"criteria": "cpe:2.3:a:gonitro:nitro_pro:13.16.2.300:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1C5AA0C-F33F-4260-8CCC-82D896186225"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}