CVE-2023-21716

CVE-2023-21716 Microsoft Word RTF フォントテーブル ヒープ破損 https://twitter.com/jduck Microsoft Office の wwlib に存在する脆弱性により、攻撃者は悪意のある RTF ドキュメントを開いた被害者の権限で、リモートコード実行を達成できます。攻撃者はこのファイルをメールの添付ファイル（またはその他の手段）として配信する可能性があります。 背景 Microsoft Word は Microsoft Office に含まれるワードプロセッサアプリケーションです。デフォルトインストールでは、Microsoft Wo...

CVE-2023-21716-Analysis-ICT287

CVE-2023-21716 分析 - ICT287: Microsoft Word リモートコード実行 概要 このリポジトリは、CVE-2023-21716（Microsoft Word の RTF パーサーにおけるヒープベースのバッファオーバーフローの脆弱性、CVSS スコア 9.8（緊急））の分析と再現を文書化しています。 内容 ファイル| 説明 ---|--- CVE-2023-21716AnalysisReport.pdf| 脆弱性の説明、影響評価、VM セットアップガイド、エクスプロイトデモのスクリーンショットを含む完全な技術分析 主な発見 根本原因 : における...

CVE-2023-21716

CVE-2023-21716 — Microsoft Word RTF fonttbl ヒープ破損 RCE 重要度: 重大 CVSS 9.8 影響を受けるバージョン: Microsoft Word 2013 / 2016 / 2019 / 2021 未パッチ パッチ: Microsoft 2023年2月の月例セキュリティ更新プログラム 作成者: REGGYRAIDER 脆弱性の概要 CVE-2023-21716 は、Microsoft Word の RTF パーサー wwlib.dll におけるヒープ破損の脆弱性です。 Word が \fonttbl ディレクティブを解析する際、32,7...

MiracleLinux 8 : java-11-openjdk-11.0.13.0.8-1.el8 (AXSA:2021-2492:13)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2492:13 advisory. OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 OpenJDK: Incorrect principal selection when using...

MiracleLinux 7 : java-11-openjdk-11.0.13.0.8-1.el7 (AXSA:2021-2490:12)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2490:12 advisory. OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 OpenJDK: Incorrect principal selection when using...

EUVD-2018-15826

Malware in sbrugna...

PT-2023-1608

Name of the Vulnerable Software and Affected Versions Microsoft Word affected versions not specified Description The issue is related to a buffer overflow in memory, allowing remote attackers to execute arbitrary code by opening a specially crafted file. This can affect the system. The...

OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

USN-5202-1: OpenJDK vulnerabilities

Varnavas Papaioannou discovered that the FTP client implementation in OpenJDK accepted alternate server IP addresses when connecting with FTP passive mode. An attacker controlling an FTP server that an application connects to could possibly use this to expose sensitive information rudimentary por...

OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

CVE-2018-4040

The CVE-2018-4040 issue affects Atlantis Word Processor versions 3.2.7.1 and 3.2.7.2, with a root cause described as an uninitialized pointer in the Rich Text Format (RTF) parser leading to heap corruption and potential code execution when a victim opens a crafted document. Cisco Talos’ advisory ...

Disappearing bytes: Reverse engineering the MS Office RTF parser

Microsoft Office was a prime target for attacks in 2017. As well as the large number of vulnerabilities discovered and proof-of-concept exploits published, malware authors felt it necessary to prevent detection of 'one-day' and 'old-day' exploits by antivirus software. It also became clear that...

The Document Foundation LibreOffice RTF Stylesheet Code Execution Vulnerability(CVE-2016-4324)

SUMMARY An exploitable Use After Free vulnerability exists in the RTF parser LibreOffice. A specially crafted file can cause a use after free resulting in a possible arbitrary code execution. To exploit the vulnerability a malicious file needs to be opened by the user via vulnerable application...

[SECURITY] [DLA 581-1] libreoffice security update

Package : libreoffice Version : 1:3.5.4+dfsg2-0+deb7u7 CVE ID : CVE-2016-4324 Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened. For Debian 7 "Wheezy", these problems have...

DLA-581-1 libreoffice - security update

Bulletin has no description...

FreeBSD : libreoffice -- use-after-free vulnerability (3159cd70-4aaa-11e6-a7bd-14dae9d210b8)

Talos reports : An exploitable Use After Free vulnerability exists in the RTF parser LibreOffice. A specially crafted file can cause a use after free resulting in a possible arbitrary code execution. To exploit the vulnerability a malicious file needs to be opened by the user via vulnerable...