Nitro has released a new version of Nitro Pro, which resolves potential security vulnerabilities. In order to avoid documents becoming read-only, please ensure that all documents opened on the same machine are closed and CHECKED IN.Ī vulnerability exists when opening a specially-crafted PDF document containing JavaScript which can lead to code execution under the context of the application. Important: To apply this fix, please upgrade to the iManage Desktop application of version 10.5 or newer. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files. An attacker can convince a user to open a document to trigger this vulnerability.Īpache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This can lead to code execution under the context of the application. When closed, the document will result in the reference being released twice. JavaScript TimeOutObject double free vulnerabilityĪ specially crafted document can cause a reference to a timeout object to be stored in two different places. Upgrade to the latest version of Nitro Pro

An attacker can convince a user to open a document to trigger this vulnerability.

JavaScript local_file_path Object use-after-free vulnerabilityĪ specially crafted document can cause an object containing the path to a document to be destroyed and then later reused, resulting in a use-after-free vulnerability, which can lead to code execution under the context of the application.

Nitro pro 13 update