PT-2012-3129 · Hancom · Hancom Office 2010 Se

Publicado 2012-02-20 · Atualizado 2017-08-29 · CVE-2012-1206

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hancom Office 2010 SE version 8.5.5

Description The issue is related to multiple integer overflows that can be triggered by large dimension values in JPG or PNG images. This can lead to a heap-based buffer overflow, allowing remote attackers to execute arbitrary code. The vulnerability can be exploited through the ImportGR in the JPG image filter module (HncJpeg10.flt) or the PNG image filter module (HncPng10.flt).

Recommendations For Hancom Office 2010 SE version 8.5.5, consider disabling the HncJpeg10.flt and HncPng10.flt modules to prevent the exploitation of this issue until a patch is available. Avoid opening or importing JPG and PNG images from untrusted sources to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2012-1206

Produtos afetados

Hancom Office 2010 Se

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/73026 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1206 · Nota de Segurança
• http://osvdb.org/78907 · Nota
• http://osvdb.org/78906 · Nota
• http://secunia.com/advisories/47386 · Aviso do Fabricante
• http://hancom.co.kr/notice.noticeView.do?targetRow=1&notice_seqno=100 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73025 · Nota
• http://securityfocus.com/bid/51892 · Nota