CVE-2020-7822 - DaviewIndy Multiple Vulnerabilities

Back Back to CVE browser

HIGH

DaviewIndy Multiple Vulnerabilities

Published Aug 4, 2020

7.8

HIGH

CVSS 3.1

EPSS 1.17%

Description

DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.

Affected products

Vendor HumanTalk Co,Ltd Product DaviewIndy Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=8.98.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

HumanTalk Co,Ltd

DaviewIndy

n/a

Version	Status	Constraints
unspecified	affected	<=8.98.7

Remediation

Vendor solution

Update software over DaviewIndy 8.98.8 0version or higher.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-787

Out-of-bounds Write

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28754
Advisory
https://www.hmtalk.com/
x_refsource_MISCProduct
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35545
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28754		Advisory
https://www.hmtalk.com/		x_refsource_MISCProduct
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35545		x_refsource_MISCThird Party Advisory