{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-39427", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-08-10T19:30:27.383Z", "datePublished": "2023-10-26T19:29:07.108Z", "dateUpdated": "2023-10-26T19:29:07.108Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Cobalt", "vendor": "Ashlar-Vellum", "versions": [{"status": "affected", "version": "v12 SP0 Build (1204.77)"}]}, {"defaultStatus": "unaffected", "product": "Xenon", "vendor": "Ashlar-Vellum", "versions": [{"status": "affected", "version": "v12 SP0 Build (1204.77)"}]}, {"defaultStatus": "unaffected", "product": "Argon", "vendor": "Ashlar-Vellum", "versions": [{"status": "affected", "version": "v12 SP0 Build (1204.77)"}]}, {"defaultStatus": "unaffected", "product": "Lithium", "vendor": "Ashlar-Vellum", "versions": [{"status": "affected", "version": "v12 SP0 Build (1204.77)"}]}, {"defaultStatus": "unaffected", "product": "Cobalt Share", "vendor": "Ashlar-Vellum", "versions": [{"status": "affected", "version": "v12 SP0 Build (1204.77)"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Michael Heinzl reported these vulnerabilities to CISA"}], "datePublic": "2023-10-26T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.</span>\n\n"}], "value": "\nIn Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-10-26T19:29:07.108Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\nAshlar-Vellum recommends users apply the following mitigations to help reduce risk:<ul><li>Cobalt, Xenon, Lithium, and Argon share update <a target=\"_blank\" rel=\"nofollow\" href=\"https://download.ashlar.com/v12/\">v12 </a>Build (1204.78).</li><li>Only open files from trusted sources.</li></ul>\n\n<br>"}], "value": "\nAshlar-Vellum recommends users apply the following mitigations to help reduce risk: * Cobalt, Xenon, Lithium, and Argon share update v12 https://download.ashlar.com/v12/ Build (1204.78).\n * Only open files from trusted sources.\n\n\n\n\n\n"}], "source": {"advisory": "ICSA-23-299-03", "discovery": "EXTERNAL"}, "title": "Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds Write", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ashlar:cobalt:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B0745B3-D36B-41AA-9E08-4E0B8D743F63", "versionEndIncluding": "12", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ashlar:graphite:*:*:*:*:*:*:*:*", "matchCriteriaId": "618E7AD7-12A1-4296-B7A5-A8ED75706334", "versionEndIncluding": "13.0.48", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ashlar:xenon:*:*:*:*:*:*:*:*", "matchCriteriaId": "3495D178-3275-4CB6-8799-139390102E20", "versionEndIncluding": "12", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ashlar:argon:*:*:*:*:*:*:*:*", "matchCriteriaId": "B70DDFE6-2136-4B49-9381-6512D946C6D4", "versionEndIncluding": "12", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ashlar:lithium:*:*:*:*:*:*:*:*", "matchCriteriaId": "55F921EC-D5BD-42E2-A755-14427D4DDC2E", "versionEndIncluding": "12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "\nIn Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.\n\n"}, {"lang": "es", "value": "En Ashlar-Vellum Cobalt, Xenon, Argon, Lithium y Cobalt Share v12 SP0 Build (1204.77), las aplicaciones afectadas carecen de una validaci\u00f3n adecuada de los datos proporcionados por el usuario al analizar archivos XE. Esto podr\u00eda provocar una escritura fuera de los l\u00edmites. Un atacante podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "id": "CVE-2023-39427", "lastModified": "2023-11-06T19:16:07.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2023-10-26T20:15:08.510", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}