PT-2024-33284 · Microsoft+1 · Office Word+1

Emin Yazi · Published 2024-10-11 · Updated 2024-10-17 · CVE-2024-48938

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Znuny versions prior to 6.5.1 through 6.5.10 Znuny versions 7.0.1 through 7.0.16

Description The issue allows for Denial of Service (DoS) or Regular Expression Denial of Service (ReDos) attacks via email. This occurs when parsing the content of emails that contain HTML code copied from Microsoft Word, leading to high CPU usage and potentially blocking the parsing process.

Recommendations For Znuny versions prior to 6.5.1 through 6.5.10, update to version 6.5.1 or later to resolve the issue. For Znuny versions 7.0.1 through 7.0.16, update to a version later than 7.0.16 to resolve the issue. As a temporary workaround, consider restricting the parsing of emails with HTML content from Microsoft Word to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-48938

Affected Products

Debian

Office Word

References · 11

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-48938 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-48938 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48938 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-48938 · Vendor Advisory
• https://znuny.org/en/advisories · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-48938 · Security Note
• https://znuny.org/en/advisories/zsa-2024-04 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-48938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48938 · Security Note
• https://znuny.com · Note
• https://t.me/cvedetector/7750 · Telegram Post