PT-2023-5667 · Accusoft · Accusoft Imagegear

Emmanuel Tacheau · Publicado 2023-09-25 · Atualizado 2023-09-25 · CVE-2023-28393

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Accusoft ImageGear version 20.1

Description A stack-based buffer overflow vulnerability exists in the tif processing dng channel count functionality. This issue is related to a buffer overflow operation. Exploitation of this vulnerability may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. A specially crafted malformed file can lead to memory corruption, and an attacker can provide a malicious file to trigger this vulnerability.

Recommendations For Accusoft ImageGear version 20.1, consider disabling the tif processing dng channel count function until a patch is available to prevent potential exploitation. Restrict access to handling malformed files to minimize the risk of triggering the buffer overflow.

Exploit

Correção

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

BDU:2023-06334

CVE-2023-28393

Produtos afetados

Accusoft Imagegear

Referências · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1742 · Exploit
• https://osv.dev/vulnerability/CVE-2023-28393 · Aviso do Fabricante
• https://help.accusoft.com/ImageGear/v20.3/Windows/DLL/webframe.html#release-notes.html · Nota
• https://help.accusoft.com/ImageGear/v20.3/Linux/webframe.html#release-notes.html · Nota
• https://vuldb.com/?id.240308 · Nota
• https://twitter.com/VulmonFeeds/status/1706379068386467861 · Publicação no Twitter
• https://twitter.com/cracbot/status/1706549238312972529 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-28393 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-06334 · Nota de Segurança