CVE-2020-10912: 
NixOS vulnerability analysis and mitigation

CVE-2020-10912 is a type confusion vulnerability discovered in Foxit PhantomPDF that was disclosed on April 16th, 2020. The vulnerability affects the SetFieldValue command of the communication API in Foxit PhantomPDF. This security flaw allows remote attackers to execute arbitrary code on affected installations of the software, though user interaction is required as the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability exists within the handling of the SetFieldValue command of the communication API. The specific issue stems from the lack of proper validation of user-supplied data, which can result in a type confusion condition. The vulnerability has been assigned a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating a high severity level (ZDI Advisory).

When successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The attack requires user interaction, specifically opening a malicious file or visiting a malicious page (ZDI Advisory).

The vulnerability requires user interaction to be exploited, where the target must either visit a malicious page or open a malicious file. The attack vector is considered local (AV:L) with low attack complexity (AC:L) and no privileges required (PR:N) (ZDI Advisory).

Foxit has released an update to correct this vulnerability. Users are advised to update their software to the latest version through the official Foxit website (ZDI Advisory).