Use-after-free in JustSystems Corporation products - CVE-2022-43664

Vulnerability identifier: #VU74339

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-43664

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing protected attribute identifier in Word processor. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Ichitaro
Raku Hagaki
Label Mighty
Hanako
JUST Office
JUST Government
JUST Police
homepage builder
Easy postcard

Install updates from vendor's website.

Ichitaro - update to 2023.4.4
Raku Hagaki - update to 2023.4.4
Label Mighty - update to 2023.4.4
Hanako - update to 2023.4.4
JUST Office - update to 2023.4.4
JUST Government - update to 2023.4.4
JUST Police - update to 2023.4.4
homepage builder - update to 2023.4.4
Easy postcard - update to 2023.4.4

• https://jvn.jp/en/jp/JVN79149117/index.html
• https://www.justsystems.com/jp/corporate/info/js23001.html
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1673

• Multiple vulnerabilities in JustSystems products