CVE-2020-10911: 
NixOS vulnerability analysis and mitigation

CVE-2020-10911 is a vulnerability discovered in Foxit PhantomPDF that affects the handling of the GetFieldValue command within the communication API. The vulnerability was reported on December 27, 2019, and publicly disclosed on April 16, 2020 (ZDI Advisory).

The vulnerability stems from the lack of proper validation of user-supplied data in the GetFieldValue command of the communication API, which can result in a type confusion condition. It received a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity (ZDI Advisory).

An attacker who successfully exploits this vulnerability can execute arbitrary code in the context of the current process. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (ZDI Advisory).

The vulnerability requires user interaction to exploit, specifically requiring the target to visit a malicious page or open a malicious file. This interaction requirement somewhat mitigates the ease of exploitation (ZDI Advisory).

Foxit has released an update to address this vulnerability. Users are advised to update their software to the latest version through the vendor's official website (Foxit Security).