Lucene search

[email protected]CVE-2023-38128

HistoryOct 19, 2023 - 6:15 p.m.

CVE-2023-38128

2023-10-1918:15:09

CWE-787

CWE-843

[email protected]

web.nvd.nist.gov

cve-2023-38128

ichitaro

hyperlinkframe

out-of-bounds write

vulnerability

memory corruption

arbitrary code execution

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

52.4%

JSON

An out-of-bounds write vulnerability exists in the “HyperLinkFrame” stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause a type confusion, which can lead to memory corruption and eventually arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

CPENameOperatorVersion
justsystems:easy_postcard_maxjustsystems easy postcard maxeq-
justsystems:ichitaro_2021justsystems ichitaro 2021eq-
justsystems:ichitaro_2022justsystems ichitaro 2022eq-
justsystems:ichitaro_2023justsystems ichitaro 2023eq1.0.1.59372
justsystems:ichitaro_government_10justsystems ichitaro government 10eq-
justsystems:ichitaro_government_8justsystems ichitaro government 8eq-
justsystems:ichitaro_government_9justsystems ichitaro government 9eq-
justsystems:ichitaro_pro_3justsystems ichitaro pro 3eq-
justsystems:ichitaro_pro_4justsystems ichitaro pro 4eq-
justsystems:ichitaro_pro_5justsystems ichitaro pro 5eq-

CPE	Name	Operator	Version
justsystems:easy_postcard_max	justsystems easy postcard max	eq	-
justsystems:ichitaro_2021	justsystems ichitaro 2021	eq	-
justsystems:ichitaro_2022	justsystems ichitaro 2022	eq	-
justsystems:ichitaro_2023	justsystems ichitaro 2023	eq	1.0.1.59372
justsystems:ichitaro_government_10	justsystems ichitaro government 10	eq	-
justsystems:ichitaro_government_8	justsystems ichitaro government 8	eq	-
justsystems:ichitaro_government_9	justsystems ichitaro government 9	eq	-
justsystems:ichitaro_pro_3	justsystems ichitaro pro 3	eq	-
justsystems:ichitaro_pro_4	justsystems ichitaro pro 4	eq	-
justsystems:ichitaro_pro_5	justsystems ichitaro pro 5	eq	-

Rows per page:

1-10 of 191

References

jvn.jp/en/jp/JVN28846531/index.html

talosintelligence.com/vulnerability_reports/TALOS-2023-1809

www.talosintelligence.com/vulnerability_reports/TALOS-2023-1809

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

52.4%

JSON

Related for CVE-2023-38128

prion1 talos1 cvelist1 talosblog2 jvn1