Lucene search

MitreCVE-2019-9116

HistoryFeb 25, 2019 - 7:29 a.m.

CVE-2019-9116

2019-02-2507:29:00

CWE-427

mitre

web.nvd.nist.gov

cve

dll hijacking

sublime text

windows

vulnerability

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

38.9%

JSON

DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or api-ms-win-core-localization-l1-2-1.dll file may be loaded if a victim uses sublime_text.exe to open a .txt file within an attacker’s %LOCALAPPDATA%\Temp\sublime_text folder. NOTE: the vendor’s position is "This does not appear to be a bug with Sublime Text, but rather one with Windows that has been patched.

Affected configurations

Nvd

Node

sublimetextsublime_text_3Match3.1.1

AND

microsoftwindows_7Match-sp1x86

VendorProductVersionCPE
sublimetextsublime_text_33.1.1cpe:2.3:a:sublimetext:sublime_text_3:3.1.1:*:*:*:*:*:*:*
microsoftwindows_7-cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*

Vendor	Product	Version	CPE
sublimetext	sublime_text_3	3.1.1	cpe:2.3:a:sublimetext:sublime_text_3:3.1.1:::::::*
microsoft	windows_7	-	cpe:2.3:o:microsoft:windows_7:-:sp1:::::x86:*

References

github.com/SublimeTextIssues/Core/issues/2544

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

38.9%

JSON

Related for CVE-2019-9116