CVE-2020-15638: 
NixOS vulnerability analysis and mitigation

This vulnerability (CVE-2020-15638) affects Foxit PhantomPDF version 9.7.2.29539, allowing remote attackers to execute arbitrary code. The vulnerability requires user interaction, specifically visiting a malicious page or opening a malicious file. The flaw was discovered in the NodeProperties::InferReceiverMapsUnsafe method (ZDI Advisory, NVD).

The vulnerability stems from the lack of proper validation of user-supplied data within the NodeProperties::InferReceiverMapsUnsafe method, which can result in a type confusion condition. The CVSS score for this vulnerability is 7.8 (High) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

When successfully exploited, this vulnerability allows attackers to execute code in the context of the current process. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of the affected system (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker needs to convince a target to either visit a malicious page or open a malicious file. The local attack vector and low attack complexity suggest relatively straightforward exploitation once user interaction is achieved (ZDI Advisory).

Foxit has released an update to address this vulnerability. Users should update their installations of Foxit PhantomPDF to the latest version through the official Foxit website (Foxit Security Bulletin).