PT-2017-8459 · Hancom · Hancom Office 2014

Publicado 2017-01-06 · Atualizado 2017-01-11 · CVE-2016-4292

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hancom Office 2014

Description The issue arises when opening a Hangul HShow Document (.hpt) and processing a structure within the document. Hancom Office 2014 allocates a heap buffer using a static size but trusts a size from the file when modifying data inside it. This discrepancy allows an aggressor to corrupt memory outside the buffer's bounds, potentially leading to code execution under the context of the application.

Recommendations For Hancom Office 2014, consider updating to a newer version that addresses this issue, as using a static size to allocate a heap buffer while trusting a size from the file can lead to memory corruption and code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-4292

Produtos afetados

Hancom Office 2014

Referências · 4

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0147 · Exploit
• https://osv.dev/vulnerability/CVE-2016-4292 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-4292 · Nota de Segurança
• http://securityfocus.com/bid/92325 · Nota