SB2021010607 - Multiple vulnerabilities in SoftMaker Office TextMaker
Published: January 6, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Unexpected Sign Extension (CVE-ID: CVE-2020-13544)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to unexpected sign extension in the TextMaker document parsing functionality within record 0x001f. A remote attacker can trick a victim to open a specially crafted document and cause the document parser to sign-extend a length used to terminate a loop, resulting in the loop’s index being used to write outside the bounds of a heap buffer during the reading of file data.
2) Unsigned to Signed Conversion Error (CVE-ID: CVE-2020-13545)
The vulnerability exists due to unsigned to signed conversion error in the TextMaker document parsing functionality within record 0x003f. A remote attacker can trick a victim to open a specially crafted document and cause the document parser to miscalculate a length used to allocate a buffer, leading to a heap-based memory corruption.
3) Integer overflow (CVE-ID: CVE-2020-13546)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in the TextMaker document parsing functionality within record 0x002a. A remote attacker can trick a victim to open a specially crafted document, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.