PT-2022-10298 · Synthesia · Synthesia

Isopach · Published 2022-11-17 · Updated 2022-11-21 · CVE-2021-33897

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Synthesia versions prior to 10.7.5567 Synthesia versions prior to 10.9

Description A buffer overflow in Synthesia, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes. This file is mishandled during a deletion attempt. Additionally, an improper path handling allows local attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes.

Recommendations For Synthesia versions prior to 10.7.5567, update to version 10.7.5567 or later to resolve the buffer overflow issue. For Synthesia versions prior to 10.9, update to version 10.9 or later to resolve the improper path handling issue. As a temporary workaround, consider avoiding the use of crafted MIDI files with malformed bytes until a patch is available. Restrict access to the MIDI file handling functionality to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-33897

Affected Products

Synthesia

References · 6

• https://osv.dev/vulnerability/CVE-2021-33897 · Vendor Advisory
• https://synthesiagame.com/news · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33897 · Security Note
• https://t.me/cvenotify/38000 · Telegram Post
• https://isopach.dev/CVE-2021-33897 · Note
• https://t.me/cibsecurity/53113 · Telegram Post