Vulnerability Spotlight: Code execution vulnerabilities in Nitro Pro PDF

guest · Oct 20, 2021

Vulnerability Spotlight: Code execution vulnerabilities in Nitro Pro PDF
October 14, 2021
https://blog.talosintelligence.com/2021/10/vuln-spotlight-nitro-pro.html

Cisco Talos recently discovered multiple vulnerabilities in the Nitro Pro PDF reader that could allow an attacker to execute code in the context of the application.

Nitro Pro PDF is part of Nitro Software’s Productivity Suite. Pro PDF allows users to create and modify PDFs and other digital documents. It includes support for several capabilities via third-party libraries to parse the PDFs.
Click to expand...

TALOS-2021-1265 (CVE-2021-21796) is a use-after-free vulnerability that can be triggered if a target opens a specially crafted, malicious PDF.

TALOS-2021-1266 (CVE-2021-21797) is a double-free vulnerability that can cause a reference to a timeout object to be stored in two different places, eventually leading to the ability to execute code under the context of the application.
Click to expand...

Log in or Sign up

Vulnerability Spotlight: Code execution vulnerabilities in Nitro Pro PDF

guest Guest

Log in or Sign up

Vulnerability Spotlight: Code execution vulnerabilities in Nitro Pro PDF

guest Guest

Useful Searches