PT-2022-13715 · Unknown · Tildearrow Furnace

Patchkey · Published 2022-04-03 · Updated 2022-04-12 · CVE-2022-1211

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tildearrow Furnace version dev73

Description A critical issue has been discovered that affects the FUR to VGM converter in console mode, causing stack-based overflows and crashes. The issue can be initiated remotely but requires user interaction.

Recommendations For version dev73, consider disabling the FUR to VGM converter in console mode until a patch is available to prevent potential exploitation. Restrict access to the converter to minimize the risk of crashes and overflows. Avoid using the converter in situations where user interaction can be manipulated. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2022-1211

Affected Products

Tildearrow Furnace

References · 6

• 🔥 https://github.com/tildearrow/furnace/issues/325 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1211 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1211 · Vendor Advisory
• https://drive.google.com/file/d/1h111beVcWG8F99jRffO7_HKYEhm7Qgvb/view?usp=sharing · Note
• https://vuldb.com/?id.196371 · Note
• https://t.me/cibsecurity/40435 · Telegram Post