Multiple vulnerabilities in CorelDRAW Standard 2020

Published: 2021-09-30

Risk	Medium
Patch available	NO
Number of vulnerabilities	2
CVE-ID	CVE-2021-38107 CVE-2021-38109
CWE-ID	CWE-125
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	CorelDRAW Standard 2020 Other software / Other software solutions
Vendor	Corel

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU56948

Risk: Medium

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2021-38107

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote attacker can use a specially crafted CDR file trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

CorelDRAW Standard 2020: All versions

External links

http://www.fortiguard.com/zeroday/FG-VD-21-039

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU56949