PT-2023-6867 · Unknown+1 · V-Server Lite+1

Michael Heinzl · Published 2023-11-10 · Updated 2023-11-21 · CVE-2023-47585

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions V-Server versions 4.0.18.0 and earlier V-Server Lite versions 4.0.18.0 and earlier

Description The issue is related to an out-of-bounds read vulnerability. This can be exploited by a remote attacker using a specially crafted file, potentially allowing the execution of arbitrary code or disclosure of information.

Recommendations For V-Server versions 4.0.18.0 and earlier, avoid opening specially crafted VPR files until a patch is available. For V-Server Lite versions 4.0.18.0 and earlier, avoid opening specially crafted VPR files until a patch is available.

Fix

Memory Corruption

Out of bounds Read

Weakness Enumeration

CWE-787

CWE-125

Related Identifiers

BDU:2023-07881

CVE-2023-47585

Affected Products

V-Server

V-Server Lite

References · 9

• https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2023-11-10.1.pdf · Security Note
• https://bdu.fstec.ru/vul/2023-07881 · Security Note
• https://hakko-elec.co.jp/site/download/03tellus_inf/index.php · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47585 · Security Note
• http://jvn.jp/en/vu/JVNVU93840158/index.html · Note
• https://jvn.jp/en/vu/JVNVU93840158 · Note
• https://t.me/cvenotify/61025 · Telegram Post