PT-2023-7339 · Kingsoft · Wps Office

Icewall + 2 · Publicado 2023-11-27 · Atualizado 2023-12-01 · CVE-2023-31275

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WPS Office version 11.2.0.11537

Description The issue is related to an uninitialized pointer use in the functionality that handles Data elements in an Excel file. This can be exploited by providing a specially crafted malformed file, potentially leading to remote code execution. An attacker can trigger this issue by providing a malicious file.

Recommendations For WPS Office version 11.2.0.11537, consider avoiding the use of the affected Excel file handling functionality until a patch is available. As a temporary workaround, refrain from opening suspicious or untrusted Excel files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Enumeração de Fraquezas

CWE-457

CWE-908

Identificadores relacionados

BDU:2023-08370

CVE-2023-31275

Produtos afetados

Wps Office

Referências · 9

• https://bdu.fstec.ru/vul/2023-08370 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-31275 · Aviso do Fabricante
• https://t.me/pentestingnews/41476 · Publicação no Telegram
• http://talosintelligence.com/reports/TALOS-2023-1748 · Nota
• https://safe-surf.ru/upload/VULN-new/VULN.2023-11-29.1.pdf · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-31275 · Nota de Segurança
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1748 · Nota
• https://t.me/cvenotify/61838 · Publicação no Telegram
• https://github.com/advisories/GHSA-cfc9-f8qw-f5wh · Nota