PT-2021-9624 · Softmaker · Textmaker

Published 2021-01-06 · Updated 2022-06-07 · CVE-2020-13544

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SoftMaker Office 2021’s TextMaker application (affected versions not specified)

Description An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality. A specially crafted document can cause the document parser to sign-extend a length used to terminate a loop, which can later result in the loop’s index being used to write outside the bounds of a heap buffer during the reading of file data. An attacker can entice the victim to open a document to trigger this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-194

CWE-681

Related Identifiers

CVE-2020-13544

Affected Products

Textmaker

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1161 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13544 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13544 · Vendor Advisory
• https://t.me/cvenotify/8208 · Telegram Post
• https://t.me/cibsecurity/21664 · Telegram Post
• https://t.me/cvenotify/8209 · Telegram Post