CVE-2020-8853: 
NixOS vulnerability analysis and mitigation

This vulnerability (CVE-2020-8853) affects Foxit PhantomPDF version 9.7.0.29478. The vulnerability was discovered in the HTML to PDF conversion functionality and was disclosed on February 11, 2020. The issue specifically affects the way the application handles the conversion of HTML files to PDF documents (ZDI Advisory, NVD).

The vulnerability stems from a lack of proper validation of user-supplied data during HTML to PDF conversion, which can result in a write past the end of an allocated structure. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue has been classified as CWE-787 (Out-of-bounds Write) (NVD, ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The attack requires user interaction, specifically the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker would need to convince a user to visit a malicious webpage or open a specially crafted malicious file. The attack vector is local (AV:L) with low attack complexity (AC:L) and requires no privileges (PR:N) (NVD).

Foxit has released security updates to address this vulnerability. Users are advised to update their Foxit PhantomPDF installations to the latest version. The fix was made available through Foxit's security bulletin (Vendor Advisory).