CVE-2017-7908

Опубликовано: 02 окт. 2018

Источник: nvd

CVSS3: 7.6

CVSS2: 6.8

EPSS Низкий

Описание

A heap-based buffer overflow exists in the third-party product Gigasoft, v5 and prior, included in GE Communicator 3.15 and prior. A malicious HTML file that loads the ActiveX controls can trigger the vulnerability via unchecked function calls.

Ссылки

http://www.securityfocus.com/bid/99580
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-275-02
Mitigation
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/99580
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-275-02
Mitigation
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gigasoft:proessentials:*:*:*:*:*:*:*:*

Версия до 5 (включая)

Конфигурация 2

cpe:2.3:a:ge:ge_communicator:*:*:*:*:*:*:*:*

Версия до 3.15 (включая)

EPSS

Процентиль: 48%

0.00252

Низкий

7.6 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-122

CWE-119

Связанные уязвимости

GHSA-qq36-4xmm-39mc