Vulnerability CVE-2014-8393


Published: 2017-08-28   Modified: 2017-08-29

Description:
DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Corel Software DLL Hijacking
CORE
14.01.2015

Type:

CWE-427

(Uncontrolled Search Path Element)

Vendor: Corel
Product: Coreldraw photo paint 
Version: x7;
Product: Coreldraw 
Version: x7;
Product: Paint shop pro 
Version: x7;
Product: Painter 
Version: 2015;
Product: Pdf fusion 

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.6/10
6.4/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://packetstormsecurity.com/files/129922/Corel-Software-DLL-Hijacking.html
http://seclists.org/fulldisclosure/2015/Jan/33
http://secunia.com/advisories/62210
http://www.coresecurity.com/advisories/corel-software-dll-hijacking
http://www.securityfocus.com/archive/1/534452/100/0/threaded
http://www.securityfocus.com/bid/72005
http://www.securitytracker.com/id/1031522

Related CVE
CVE-2019-6114
An issue was discovered in Corel PaintShop Pro 2019 21.0.0.119. An integer overflow in the jp2 parsing library allows an attacker to overwrite memory and to execute arbitrary code.
CVE-2017-2804
A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a ...
CVE-2017-2803
A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 version 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the v...
CVE-2016-9043
An out of bound write vulnerability exists in the EMF parsing functionality of CorelDRAW X8 (CdrGfx - Corel Graphics Engine (64-Bit) - 18.1.0.661). A specially crafted EMF file can cause a vulnerability resulting in potential code execution. An attac...
CVE-2016-8730
An of bound write / memory corruption vulnerability exists in the GIF parsing functionality of Core PHOTO-PAINT X8 18.1.0.661. A specially crafted GIF file can cause a vulnerability resulting in potential memory corruption resulting in code execution...
CVE-2015-6948
Heap-based buffer overflow in the Microsoft Word document conversion feature in Corel WordPerfect allows remote attackers to execute arbitrary code via a crafted document.
CVE-2014-8398
Multiple untrusted search path vulnerabilities in Corel FastFlick allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) igfxcmrt32.dll, (2) ipl.dll, (3) MSPStyleLib.dll, (4) uFioUtil.dll, (5) uhDSPlay.dl...
CVE-2014-8397
Untrusted search path vulnerability in Corel VideoStudio PRO X7 or FastFlick allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse u32ZLib.dll file that is located in the same folder as the file being proce...

Copyright 2019, cxsecurity.com

 

Back to Top