PT-2018-16371 · Atlantis · Atlantis Word Processor

Publicado 2018-12-01 · Atualizado 2022-06-07 · CVE-2018-4038

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlantis Word Processor version 3.2.7.2

Description The issue is related to an arbitrary write vulnerability in the open document format parser. It occurs when the parser attempts to null-terminate a string, allowing an attacker to pass an untrusted value as a length to a constructor. This can lead to memory corruption, potentially resulting in code execution under the context of the application. The vulnerability can be triggered by convincing a victim to open a specially crafted document.

Recommendations For Atlantis Word Processor version 3.2.7.2, consider avoiding the use of the open document format parser until a patch is available. As a temporary workaround, restrict the opening of documents from untrusted sources to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-131

Identificadores relacionados

CVE-2018-4038

Produtos afetados

Atlantis Word Processor

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0711 · Exploit
• https://osv.dev/vulnerability/CVE-2018-4038 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-4038 · Nota de Segurança