CVE-2020-7816 - A vulnerability in the JPEG image parsing module in DaView Indy, DaVa+, DaOffice softwares could all

CVE-2020-7816

Summary

A vulnerability in the JPEG image parsing module in DaView Indy, DaVa+, DaOffice softwares could allow an unauthenticated, remote attacker to cause an arbitrary code execution on an affected device.nThe vulnerability is due to a stack overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device.

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35483

Vulnerable Configurations

cpe:2.3:a:hmtalk:daoffice:-:*:*:*:*:*:*:*
cpe:2.3:a:hmtalk:daoffice:-:*:*:*:*:*:*:*
cpe:2.3:a:hmtalk:dava\+:-:*:*:*:*:*:*:*
cpe:2.3:a:hmtalk:dava\+:-:*:*:*:*:*:*:*
cpe:2.3:a:hmtalk:daview_indy:-:*:*:*:*:*:*:*
cpe:2.3:a:hmtalk:daview_indy:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 21-07-2021 - 11:39)
Impact:
Exploitability:

CWE

CWE-787

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

confirm

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35483

Last major update

21-07-2021 - 11:39

Published

30-06-2020 - 14:15

Last modified

21-07-2021 - 11:39