CVE-2022-3377

Опубликовано: 15 нояб. 2022

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory read.

Ссылки

https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-03
Patch
Third Party Advisory
US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-03
Patch
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:hornerautomation:cscape:*:*:*:*:*:*:*:*

Версия до 9.90 (исключая)

cpe:2.3:a:hornerautomation:cscape:9.90:-:*:*:*:*:*:*

cpe:2.3:a:hornerautomation:cscape:9.90:sp1:*:*:*:*:*:*

cpe:2.3:a:hornerautomation:cscape:9.90:sp2:*:*:*:*:*:*

cpe:2.3:a:hornerautomation:cscape:9.90:sp3:*:*:*:*:*:*

cpe:2.3:a:hornerautomation:cscape:9.90:sp4:*:*:*:*:*:*

cpe:2.3:a:hornerautomation:cscape:9.90:sp5:*:*:*:*:*:*

cpe:2.3:a:hornerautomation:cscape:9.90:sp6:*:*:*:*:*:*

EPSS

Процентиль: 21%

0.00068

Низкий

7.8 High

CVSS3

Дефекты

CWE-824

Связанные уязвимости

GHSA-jgp5-g9cp-mgfw