PT-2018-14261 · Omron · Cx-Supervisor

Publicado 2018-10-17 · Atualizado 2019-10-09 · CVE-2018-17909

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Omron CX-Supervisor versions 3.4.1.0 and prior

Description The issue arises when processing project files, where the application fails to check if it is referencing freed memory. This may allow an attacker to execute code under the context of the application. The vulnerability is related to the parsing of certain file types, including sr3, SCS, and PAG files.

Recommendations For Omron CX-Supervisor versions 3.4.1.0 and prior, update to a version that includes a fix for the use-after-free vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2018-17909

ZDI-18-1279

ZDI-18-1281

ZDI-18-1282

ZDI-18-1283

ZDI-18-1284

ZDI-18-1446

Produtos afetados

Cx-Supervisor

Referências · 10

• https://zerodayinitiative.com/advisories/ZDI-18-1283 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-18-1281 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17909 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-18-1284 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-18-1282 · Nota de Segurança
• http://securityfocus.com/bid/105691 · Nota
• https://zerodayinitiative.com/advisories/ZDI-18-1446 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-18-290-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-17909 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-18-1279 · Nota de Segurança