CVE-2020-10906: 
NixOS vulnerability analysis and mitigation

CVE-2020-10906 is a use-after-free vulnerability discovered in Foxit Reader version 9.7.1.29511. The vulnerability was reported on March 15, 2020, and publicly disclosed on April 16, 2020. The flaw affects the resetForm method in Foxit Reader and allows remote attackers to execute arbitrary code on affected installations (Zero Day Initiative, NVD).

The vulnerability exists within the resetForm method of Foxit Reader. The specific issue stems from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Zero Day Initiative, NVD).

An attacker can leverage this vulnerability to execute code in the context of the current process. The vulnerability requires user interaction to be exploited, as the target must visit a malicious page or open a malicious file (Zero Day Initiative).

Foxit has issued an update to correct this vulnerability. Users are advised to update their installations to the latest version of Foxit Reader. The fix is available through the official Foxit security bulletins (Foxit Security Bulletin).