Vulnerability · Published Aug 12, 2020 · Assigned by rapid7
CVE-2020-7374Documalis Free PDF Editor / Free PDF Scanner Stack Based Buffer Overflow
Medium 5.3
In plain English
A medium-severity buffer overflow in Free PDF Editor from Documalis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Documalis | Free PDF Editor | 5.7.2.26 |
| Documalis | Free PDF Scanner | 5.7.2.122 |
Weakness: CWE-120 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/rapid7/metasploit-framework/pull/13517 x_refsource_MISC