CVE-2016-4292

When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a static size to allocate a heap buffer yet explicitly trust a size from the file when modifying data inside of it. Due to this, an aggressor can corrupt memory outside the bounds of this buffer which can lead to code execution under the context of the application.
References
Link Resource
http://www.securityfocus.com/bid/92325
http://www.talosintelligence.com/reports/TALOS-2016-0147/ Exploit Technical Description Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:hancom:hancom_office_2014:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-01-06 21:59

Updated : 2024-02-04 19:11


NVD link : CVE-2016-4292

Mitre link : CVE-2016-4292

CVE.ORG link : CVE-2016-4292


JSON object : View

Products Affected

hancom

  • hancom_office_2014
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer