CVE-2023-34288

Ashlar-Vellum Cobalt XE File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17966.
Configurations

No configuration.

History

21 Nov 2024, 08:06

Type Values Removed Values Added
References () https://www.zerodayinitiative.com/advisories/ZDI-23-826/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-826/ -

18 Sep 2024, 19:15

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de ejecución remota de código de puntero no inicializado en el análisis de archivos Ashlar-Vellum Cobalt XE. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de Ashlar-Vellum Cobalt. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XE. El problema se debe a la falta de una inicialización adecuada de un puntero antes de acceder a él. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-17966.
Summary (en) Ashlar-Vellum Cobalt XE File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17966. (en) Ashlar-Vellum Cobalt XE File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17966.

03 May 2024, 02:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-05-03 02:15

Updated : 2024-11-21 08:06


NVD link : CVE-2023-34288

Mitre link : CVE-2023-34288

CVE.ORG link : CVE-2023-34288


JSON object : View

Products Affected

No product.

CWE
CWE-824

Access of Uninitialized Pointer