Heap-based buffer overflow in JustSystems Corporation products - CVE-2023-22660

Vulnerability identifier: #VU74342

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22660

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing "LayoutBox" stream. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Ichitaro
Raku Hagaki
Label Mighty
Hanako
JUST Office
JUST Government
JUST Police
homepage builder
Easy postcard

Install updates from vendor's website.

Ichitaro - update to 2023.4.4
Raku Hagaki - update to 2023.4.4
Label Mighty - update to 2023.4.4
Hanako - update to 2023.4.4
JUST Office - update to 2023.4.4
JUST Government - update to 2023.4.4
JUST Police - update to 2023.4.4
homepage builder - update to 2023.4.4
Easy postcard - update to 2023.4.4

• https://jvn.jp/en/jp/JVN79149117/index.html
• https://www.justsystems.com/jp/corporate/info/js23001.html
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1722

• Multiple vulnerabilities in JustSystems products