CVE-2023-34366
Estado: ModificadaAlta (7.8)—
A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause memory corruption, resulting in arbitrary code execution. Victim would need to open a malicious file to trigger this vulnerability.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.64%
- Percentil entre todas las CVEs puntuadas: 49
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (19)
Justsystems — Easy Postcard MAXJustsystems — Ichitaro 2021Justsystems — Ichitaro 2022Justsystems — Ichitaro 2023Justsystems — Ichitaro Government 10Justsystems — Ichitaro Government 8Justsystems — Ichitaro Government 9Justsystems — Ichitaro PRO 3Justsystems — Ichitaro PRO 4Justsystems — Ichitaro PRO 5Justsystems — Just Government 3Justsystems — Just Government 4Justsystems — Just Government 5Justsystems — Just Office 3Justsystems — Just Office 4Justsystems — Just Office 5Justsystems — Just Police 3Justsystems — Just Police 4Justsystems — Just Police 5
CWE
- CWE-416
- CWE-416
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-34366",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-34366",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-12T18:05:09.536876Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "talos-cna@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "talos-cna@cisco.com",
"affectedData": [
{
"vendor": "Ichitaro 2023",
"product": "Ichitaro 2023",
"versions": [
{
"status": "affected",
"version": "1.0.1.59372"
}
]
}
]
}
],
"published": "2023-10-19T18:15:08.983",
"references": [
{
"url": "https://jvn.jp/en/jp/JVN28846531/index.html",
"tags": [
"Third Party Advisory"
],
"source": "talos-cna@cisco.com"
},
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1758",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "talos-cna@cisco.com"
},
{
"url": "https://jvn.jp/en/jp/JVN28846531/index.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1758",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1758",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "talos-cna@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause memory corruption, resulting in arbitrary code execution. Victim would need to open a malicious file to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de use-after-free en la funcionalidad de análisis de flujo de figuras de Ichitaro 2023 1.0.1.59372. Un documento especialmente manipulado puede causar daños en la memoria, lo que resulta en la ejecución de código arbitrario. La víctima necesitaría abrir un archivo malicioso para activar esta vulnerabilidad."
}
],
"lastModified": "2026-06-17T06:03:29.460",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:justsystems:easy_postcard_max:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D68E98B0-38CA-4148-825D-CF7C8AABB5BE"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_2021:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1755383C-2B74-4DD7-9C9B-DB19C12CA94D"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_2022:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1274E0AB-BDE0-45FB-B3A2-522E3AE4E41A"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_2023:1.0.1.59372:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "15B1DC82-380D-4CF4-AF35-4AF2A1CBF778"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_government_10:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A1C403A-6787-4347-AF6F-69F225944011"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_government_8:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E401B098-6551-4101-9906-19C2AB7A5504"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_government_9:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65A56D02-7438-4319-BFD1-64FB11BC758C"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_pro_3:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36AE4633-5418-4009-B51D-4A1F542B1A88"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_pro_4:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21A4F85C-EA95-4853-9A8C-C3C9142243A8"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_pro_5:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76FAE0E6-1037-45AC-A277-8F32338A50AD"
},
{
"criteria": "cpe:2.3:a:justsystems:just_government_3:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "552D41EF-A5DB-4ED0-B404-FF2649969B11"
},
{
"criteria": "cpe:2.3:a:justsystems:just_government_4:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F61D3C1-0011-4D78-83F8-2349D46AFE59"
},
{
"criteria": "cpe:2.3:a:justsystems:just_government_5:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC99A5A2-32B0-4F38-A2B1-FAC50A05FBEF"
},
{
"criteria": "cpe:2.3:a:justsystems:just_office_3:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7814DB96-4078-47B8-93B2-5066029B6F65"
},
{
"criteria": "cpe:2.3:a:justsystems:just_office_4:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D8E2A1A-7C06-491F-8A28-BE70EFCDDFFF"
},
{
"criteria": "cpe:2.3:a:justsystems:just_office_5:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD6F3523-7059-4591-9D04-97D287128D6E"
},
{
"criteria": "cpe:2.3:a:justsystems:just_police_3:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5ED46089-ED5B-4314-B079-A8932377475E"
},
{
"criteria": "cpe:2.3:a:justsystems:just_police_4:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3B6B97E-B202-4B1F-9B81-367CB7172DEB"
},
{
"criteria": "cpe:2.3:a:justsystems:just_police_5:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B5D80C5-5821-416E-A3E3-ADC7F221B093"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "talos-cna@cisco.com"
}