Vulnerability Description
An integer overflow exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allow for memory corruption, potentially resulting in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Justsystems | Easy Postcard Max | - |
| Justsystems | Ichitaro 2021 | - |
| Justsystems | Ichitaro 2022 | - |
| Justsystems | Ichitaro 2023 | 1.0.1.59372 |
| Justsystems | Ichitaro Government 10 | - |
| Justsystems | Ichitaro Government 8 | - |
| Justsystems | Ichitaro Government 9 | - |
| Justsystems | Ichitaro Pro 3 | - |
| Justsystems | Ichitaro Pro 4 | - |
| Justsystems | Ichitaro Pro 5 | - |
| Justsystems | Just Government 3 | - |
| Justsystems | Just Government 4 | - |
| Justsystems | Just Government 5 | - |
| Justsystems | Just Office 3 | - |
| Justsystems | Just Office 4 | - |
| Justsystems | Just Office 5 | - |
| Justsystems | Just Police 3 | - |
| Justsystems | Just Police 4 | - |
| Justsystems | Just Police 5 | - |
Related Weaknesses (CWE)
References
- https://jvn.jp/en/jp/JVN28846531/index.htmlThird Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1808ExploitThird Party Advisory
- https://jvn.jp/en/jp/JVN28846531/index.htmlThird Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1808ExploitThird Party Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1808
FAQ
What is CVE-2023-38127?
CVE-2023-38127 is a vulnerability with a CVSS score of 7.8 (HIGH). An integer overflow exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allo...
How severe is CVE-2023-38127?
CVE-2023-38127 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-38127?
Check the references section above for vendor advisories and patch information. Affected products include: Justsystems Easy Postcard Max, Justsystems Ichitaro 2021, Justsystems Ichitaro 2022, Justsystems Ichitaro 2023, Justsystems Ichitaro Government 10.