PT-2021-7262 · Corel · Corel Drawstandard 2020

Kushal Arvind Shah · Published 2021-03-01 · Updated 2021-10-07 · CVE-2021-38107

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Corel DrawStandard 2020 version 22.0.0.474

Description The issue is related to an Out-of-bounds Read vulnerability when parsing a crafted file, which could allow an unauthenticated attacker to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious CDR file. This vulnerability is associated with the CdrCore.dll library in the Corel DrawStandard 2020.

Recommendations For Corel DrawStandard 2020 version 22.0.0.474, consider avoiding the use of CdrCore.dll library until a patch is available. As a temporary workaround, refrain from opening suspicious or untrusted CDR files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-04581

CVE-2021-38107

Affected Products

Corel Drawstandard 2020

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-38107 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38107 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04581 · Security Note
• https://fortiguard.com/zeroday/FG-VD-21-039 · Note
• https://t.me/cvenotify/22060 · Telegram Post
• https://t.me/cvenotify/21858 · Telegram Post
• https://fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products · Note