PT-2023-5556 · Accusoft · Accusoft Imagegear

Emmanuel Tacheau · Publicado 2023-05-12 · Atualizado 2023-09-26 · CVE-2023-32614

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Accusoft ImageGear version 20.1

Description A heap-based buffer overflow vulnerability exists in the create png object() functionality. This issue is related to a buffer overflow, which can be triggered by a specially crafted malicious PNG file, potentially leading to memory corruption. An attacker can exploit this vulnerability by providing a malicious file, affecting the confidentiality, integrity, and availability of protected information.

Recommendations For Accusoft ImageGear version 20.1, consider disabling the create png object() function until a patch is available to prevent potential exploitation. Restrict the handling of PNG files from untrusted sources to minimize the risk of triggering this vulnerability.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-124

CWE-787

Identificadores relacionados

BDU:2023-06207

CVE-2023-32614

Produtos afetados

Accusoft Imagegear

Referências · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1749 · Exploit
• https://bdu.fstec.ru/vul/2023-06207 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-32614 · Aviso do Fabricante
• https://vuldb.com/ru/?id.240309 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-32614 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1706381855132385523 · Publicação no Twitter
• https://twitter.com/cracbot/status/1706549241383206981 · Publicação no Twitter