CVE-2020-12248: Buffer Overflow
Published Sep 4, 2020
·Updated
In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer overflow because dirty image-resource data is mishandled.
Affected Software
4 affected components
Foxitsoftware Phantompdf<=9.7.2.29539
Microsoft Windows
Foxitsoftware Phantompdf<=10.0.0.35798
Foxitsoftware Reader<=10.0.0.35798
Event History
Sep 4, 2020
CVE Published
via MITRE·03:32 AM
Data Sourced
via MITRE·03:32 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-12248.
2
What is the severity level of CVE-2020-12248?
CVE-2020-12248 has a severity level of 8.8, which is considered high.
3
How does this vulnerability occur in Foxit Reader and PhantomPDF?
This vulnerability occurs in Foxit Reader and PhantomPDF due to a heap-based buffer overflow that is caused by mishandling dirty image-resource data.
4
Which versions of Foxit Reader and PhantomPDF are affected by CVE-2020-12248?
Foxit Reader versions up to and including 10.0.0.35798 and PhantomPDF versions up to and including 9.7.2.29539 are affected by CVE-2020-12248.
5
How can an attacker exploit CVE-2020-12248?
An attacker can exploit CVE-2020-12248 by executing arbitrary code through the heap-based buffer overflow.