CVE-2023-34366

CVE-2023-34366 affects Ichitaro 2023 Word Processor (JustSystems). Cisco Talos documents a use-after-free in the Figure stream parsing for the DocumentViewStyles/DocumentEditStyles streams, leading to memory corruption and potential arbitrary code execution when a malicious file is opened. Techni...

CVE-2022-43664

CVE-2022-43664 affects Ichitaro Word Processor 2022 (version 1.0.1.57600). Cisco Talos and Red Hat advisories describe a use-after-free vulnerability in the handling of protected documents that can trigger memory reuse, causing memory corruption and potential arbitrary code execution when a speci...

CVE-2023-35126

CVE-2023-35126 affects JustSystems Ichitaro 2023 where the vulnerability resides in the parsing of the DocumentViewStyles and DocumentEditStyles streams (record type 0x2008). The root cause is an out-of-bounds index into a 6-element lv_objects array used during readStyleType(2008), which enables ...

CVE-2023-22291

CVE-2023-22291 affects Ichitaro 2022 (version 1.0.1.57600) and is a Frame stream parser invalid free vulnerability that can lead to memory corruption when processing specially crafted JTD documents. Talos’ analysis confirms the vulnerability exists in the Frame stream handling within the JTD proc...

CVE-2023-38127

CVE-2023-38127 : An integer overflow in Ichitaro 2023 (version 1.0.1.59372) HyperLinkFrame stream parsing can cause an under-sized allocation, enabling memory corruption and potential arbitrary code execution via a crafted document. The vulnerability is exposed during parsing of the DocumentViewS...

CVE-2023-38128

CVE-2023-38128 : In Ichitaro 2023 (version 1.0.1.59372), a vulnerability exists in the HyperLinkFrame stream parser that allows an out-of-bounds write, causing a type confusion, memory corruption, and potential arbitrary code execution. Cisco Talos details a chain where an input document’s 0x2008...

CVE-2022-45115

CVE-2022-45115 concerns a buffer overflow in Ichitaro 2022 (version 1.0.1.57600) within the Attribute Arena processing of the file’s SummaryInformation stream. Cisco Talos documents a heap-based overflow caused by computing the arena size from two header fields of the 0x40 JSRV_SummaryInformation...

CVE-2023-22660

CVE-2023-22660 affects JustSystems Ichitaro 2022, version 1.0.1.57600, via a heap-based buffer overflow in processing certain LayoutBox stream records (Frame/LayoutBox) in JTD documents. A specially crafted document can trigger memory corruption, potentially enabling arbitrary code execution when...