PT-2021-7556 · Corel · Corel Presentations

Kushal Arvind Shah · Published 2021-03-01 · Updated 2021-10-07 · CVE-2021-38106

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Corel Presentations version 2020 20.0.0.200

Description The issue is related to an out-of-bounds read vulnerability in the UAX200.dll library of Corel Presentations. This vulnerability can be exploited by an unauthenticated attacker to access unauthorized system memory in the context of the current user. Exploitation requires user interaction, where a victim must open a specially crafted PPT file.

Recommendations For Corel Presentations version 2020 20.0.0.200, consider avoiding the use of the UAX200.dll library until a patch is available. As a temporary workaround, restrict the opening of PPT files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2023-00016

CVE-2021-38106

Affected Products

Corel Presentations

References · 6

• https://bdu.fstec.ru/vul/2023-00016 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-38106 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38106 · Vendor Advisory
• https://fortiguard.com/zeroday/FG-VD-21-034 · Note
• https://t.me/cvenotify/21849 · Telegram Post
• https://fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products · Note