CVE-2020-8852: 
NixOS vulnerability analysis and mitigation

This vulnerability (CVE-2020-8852) affects Foxit Reader version 9.7.0.29455. The vulnerability allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability exists within the processing of JPEG2000 files. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 score of 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) (ZDI Advisory).

An attacker can leverage this vulnerability to disclose sensitive information from the affected system. The vulnerability only allows information disclosure without any ability to modify or destroy data (ZDI Advisory).

The vulnerability requires user interaction to be exploited, as the target must visit a malicious page or open a malicious file. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute code in the context of the current process (ZDI Advisory).

Foxit has issued an update to correct this vulnerability. Users should update to the latest version of the software. More details about the fix can be found on Foxit's security bulletins page (ZDI Advisory).