PT-2021-7271 · Corel · Corel Photopaint Standard

Kushal Arvind Shah · Published 2021-03-01 · Updated 2021-10-08 · CVE-2021-38101

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Corel PhotoPaint Standard version 22.0.0.474

Description The issue is related to an out-of-bounds read in the CDRRip.dll library, which can be exploited by a remote attacker to execute arbitrary code in the context of the current user. This can be achieved by using a specially crafted CPT file. The exploitation requires user interaction, as the victim must open the malicious file.

Recommendations For Corel PhotoPaint Standard version 22.0.0.474, consider avoiding the use of the CDRRip.dll library until a patch is available. As a temporary workaround, refrain from opening untrusted CPT files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-04753

CVE-2021-38101

Affected Products

Corel Photopaint Standard

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-38101 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38101 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04753 · Security Note
• https://t.me/cvenotify/21852 · Telegram Post
• https://t.me/cvenotify/21841 · Telegram Post
• https://t.me/cvenotify/22181 · Telegram Post
• https://t.me/cibsecurity/29843 · Telegram Post
• https://fortiguard.com/zeroday/FG-VD-21-028 · Note
• https://fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products · Note