Multiple vulnerabilities in JustSystems products
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2022-43664 CVE-2022-45115 CVE-2023-22291 CVE-2023-22660 |
| CWE-ID | CWE-416 CWE-122 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Ichitaro Client/Desktop applications / Office applications Hanako Client/Desktop applications / Office applications Label Mighty Client/Desktop applications / Office applications Raku Hagaki Client/Desktop applications / Office applications Easy postcard Client/Desktop applications / Office applications JUST Office Client/Desktop applications / Office applications JUST Government Client/Desktop applications / Office applications JUST Police Client/Desktop applications / Office applications homepage builder Client/Desktop applications / Office applications |
| Vendor | JustSystems Corporation |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Use-after-free
EUVDB-ID: #VU74339
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-43664
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing protected attribute identifier in Word processor. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIchitaro: 2021 - Viewer
Hanako: Personal 2021 - Pro 5
Label Mighty: 17 - POP in Shop12
Raku Hagaki: Max
Easy postcard: 2021
JUST Office: 3 - 5
JUST Government: 3 - 5
JUST Police: 3 - 5
homepage builder: 21
External linkshttp://jvn.jp/en/jp/JVN79149117/index.html
http://www.justsystems.com/jp/corporate/info/js23001.html
http://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1673
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Heap-based buffer overflow
EUVDB-ID: #VU74340
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-45115
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the Attribute Arena functionality. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIchitaro: 2021 - Viewer
Hanako: Personal 2021 - Pro 5
Label Mighty: 17 - POP in Shop12
Raku Hagaki: Max
Easy postcard: 2021
JUST Office: 3 - 5
JUST Government: 3 - 5
JUST Police: 3 - 5
homepage builder: 21
External linkshttp://jvn.jp/en/jp/JVN79149117/index.html
http://www.justsystems.com/jp/corporate/info/js23001.html
http://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1684
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Heap-based buffer overflow
EUVDB-ID: #VU74341
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-22291
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Frame stream parser. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIchitaro: 2021 - Viewer
Hanako: Personal 2021 - Pro 5
Label Mighty: 17 - POP in Shop12
Raku Hagaki: Max
Easy postcard: 2021
JUST Office: 3 - 5
JUST Government: 3 - 5
JUST Police: 3 - 5
homepage builder: 21
External linkshttp://jvn.jp/en/jp/JVN79149117/index.html
http://www.justsystems.com/jp/corporate/info/js23001.html
http://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1687
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Heap-based buffer overflow
EUVDB-ID: #VU74342
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-22660
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing "LayoutBox" stream. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIchitaro: 2021 - Viewer
Hanako: Personal 2021 - Pro 5
Label Mighty: 17 - POP in Shop12
Raku Hagaki: Max
Easy postcard: 2021
JUST Office: 3 - 5
JUST Government: 3 - 5
JUST Police: 3 - 5
homepage builder: 21
External linkshttp://jvn.jp/en/jp/JVN79149117/index.html
http://www.justsystems.com/jp/corporate/info/js23001.html
http://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1722
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
