7.8

CVE-2022-39843

Exploit
123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attackers to execute arbitrary code via a crafted worksheet. This occurs because of a stack-based buffer overflow in the cell format processing routines, as demonstrated by a certain function call from process_fmt() that can be reached via a w3r_format element in a wk3 document.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lotus 1-2-3 Project ≫ Lotus 1-2-3 Version1.0.0 Updaterc1
   Linux ≫ Linux Kernel Version-
Lotus 1-2-3 Project ≫ Lotus 1-2-3 Version1.0.0 Updaterc2
   Linux ≫ Linux Kernel Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.327
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://github.com/taviso/123elf/issues/103
Third Party Advisory
Exploit
Issue Tracking