JVN#71404925: Multiple vulnerabilities in UTAU

UTAU provided by ameya/ayame contains multiple vulnerabilities listed below.

OS command injection (CWE-78) CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Base Score 5.3 CVE-2024-28886Path Traversal (CWE-22) CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score 3.3 CVE-2024-32944

Impact

• If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed (CVE-2024-28886)
• If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip file) to UTAU, an arbitrary file may be placed (CVE-2024-32944)

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.

Products Affected

• UTAU versions prior to v0.4.19