Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2016-4298
Deferred
More InfoOfficial Page
Source-cret@cert.org
View Known Exploited Vulnerability (KEV) details
Published At-06 Jan, 2017 | 21:59
Updated At-20 Apr, 2025 | 01:37

When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will attempt to allocate space for a list of elements using a length from the file. When calculating this length, an integer overflow can be made to occur which will cause the buffer to be undersized when the application tries to copy file data into the object containing this structure. This allows one to overwrite contiguous data in the heap which can lead to code-execution under the context of the application.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.07.8HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary2.06.8MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Type: Primary
Version: 3.0
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Type: Primary
Version: 2.0
Base score: 6.8
Base severity: MEDIUM
Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
CPE Matches

hancom
hancom
>>hancom_office_2014>>Versions up to 9.1.0.2176(inclusive)
cpe:2.3:a:hancom:hancom_office_2014:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-190Primarynvd@nist.gov
CWE ID: CWE-190
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
http://www.securityfocus.com/bid/92325cret@cert.org
N/A
http://www.talosintelligence.com/reports/TALOS-2016-0144/cret@cert.org
Exploit
Technical Description
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/92325af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.talosintelligence.com/reports/TALOS-2016-0144/af854a3a-2127-422b-91ae-364da2661108
Exploit
Technical Description
Third Party Advisory
VDB Entry
Hyperlink: http://www.securityfocus.com/bid/92325
Source: cret@cert.org
Resource: N/A
Hyperlink: http://www.talosintelligence.com/reports/TALOS-2016-0144/
Source: cret@cert.org
Resource:
Exploit
Technical Description
Third Party Advisory
VDB Entry
Hyperlink: http://www.securityfocus.com/bid/92325
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.talosintelligence.com/reports/TALOS-2016-0144/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Technical Description
Third Party Advisory
VDB Entry
Change History
0Changes found

Details not found