PT-2021-9646 · Softmaker · Softmaker Office

Published 2021-02-04 · Updated 2022-06-07 · CVE-2020-13579

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SoftMaker Office 2021’s PlanMaker application (affected versions not specified)

Description An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality. A specially crafted document can cause the document parser to perform arithmetic that may overflow, resulting in an undersized heap allocation. Later, when copying data from the file into this allocation, a heap-based buffer overflow will occur, which can corrupt memory. These types of memory corruptions can allow for code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

CVE-2020-13579

Affected Products

Softmaker Office

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1190 · Exploit
• https://osv.dev/vulnerability/CVE-2020-13579 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13579 · Security Note
• https://t.me/cibsecurity/23048 · Telegram Post
• https://t.me/cvenotify/9401 · Telegram Post