« Volver al listado

CVE-2018-5201

Estado: ModificadaMedia (5.5)—

Hancom Office 2018 10.0.0.8214 and earlier, Hancom Office NEO 9.6.1.10472 and earlier, Hancom Office 2014 9.1.1.4540 and earlier, Hancom Office 2010 8.5.8.1724 and earlier versions have a heap overflow vulnerability when handling Compound File in document. This result in a program crash or denial of service conditions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Hancom — Hancom Office 2010Hancom — Hancom Office 2014Hancom — Hancom Office 2018Hancom — Hancom Office NEO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-5201",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "vuln@krcert.or.kr",
      "affectedData": [
        {
          "vendor": "HANCOM",
          "product": "Hancom Office",
          "versions": [
            {
              "status": "affected",
              "version": "Hancom Office 2018 10.0.0.8214 and earlier, Hancom Office NEO 9.6.1.10472 and earlier, Hancom Office 2014 9.1.1.4540 and earlier, Hancom Office 2010 8.5.8.1724 and earlier versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-21T16:29:00.240",
  "references": [
    {
      "url": "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30116",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vuln@krcert.or.kr"
    },
    {
      "url": "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30116",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hancom Office 2018 10.0.0.8214 and earlier, Hancom Office NEO 9.6.1.10472 and earlier, Hancom Office 2014 9.1.1.4540 and earlier, Hancom Office 2010 8.5.8.1724 and earlier versions have a heap overflow vulnerability when handling Compound File in document. This result in a program crash or denial of service conditions."
    },
    {
      "lang": "es",
      "value": "Hancom Office 2018, en versiones 10.0.0.8214 y anteriores; Hancom Office NEO, en versiones 9.6.1.10472 y anteriores; Hancom Office 2014, en versiones 9.1.1.4540 y anteriores; y Hancom Office 2010, en versiones 8.5.8.1724 y anteriores, tienen una vulnerabilidad de desbordamiento de memoria dinámica (heap) al manejar un archivo compuesto en un documento. Esto resulta en un cierre inesperado del programa o en una denegación de servicio (DoS)."
    }
  ],
  "lastModified": "2026-06-17T01:59:49.973",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hancom:hancom_office_2010:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D01D4332-A33A-498F-BD3B-A3D89BBCCF49",
              "versionEndIncluding": "8.5.8.1724"
            },
            {
              "criteria": "cpe:2.3:a:hancom:hancom_office_2014:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F2B592D-EE5B-417C-BC1E-EDA15E53CA79",
              "versionEndIncluding": "9.1.1.4540"
            },
            {
              "criteria": "cpe:2.3:a:hancom:hancom_office_2018:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB84EA19-F167-477D-8DB4-88FF2536797D",
              "versionEndIncluding": "10.0.0.8214"
            },
            {
              "criteria": "cpe:2.3:a:hancom:hancom_office_neo:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6594512A-F266-42B3-A140-6A66BFE4837D",
              "versionEndIncluding": "9.6.1.10472"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vuln@krcert.or.kr"
}