CVE-2020-10910: 
NixOS vulnerability analysis and mitigation

CVE-2020-10910 is a vulnerability in Foxit PhantomPDF that was discovered and disclosed in April 2020. The vulnerability affects the handling of the RotatePage command within the communication API of Foxit PhantomPDF. This security issue was reported to the vendor on December 27, 2019, and was publicly disclosed on April 16, 2020 (ZDI Advisory).

The vulnerability stems from the lack of proper validation of user-supplied data in the RotatePage command of the communication API, which can result in a type confusion condition. The severity of this vulnerability is rated as high with a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (ZDI Advisory).

An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. The exploitation requires user interaction, specifically the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction to be exploited, as the target must visit a malicious page or open a malicious file. The attack complexity is considered low, but requires local access (ZDI Advisory).

Foxit has issued an update to correct this vulnerability. Users are advised to update to the latest version of the software through the official Foxit website (ZDI Advisory).