CVE-2018-3999: atlantiswordprocessor atlantis_word_processor Integer Underflow (Wrap or Wraparound)

Vulnerability summary

CVE-2018-3999 is a high (CVSS 8.8) Integer Underflow (Wrap or Wraparound) vulnerability in atlantiswordprocessor atlantis_word_processor. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-10-2018
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

An exploitable stack-based buffer overflow vulnerability exists in the JPEG parser of Atlantis Word Processor, version 3.2.5.0. A specially crafted image embedded within a document can cause a length to be miscalculated and underflow. This length is then treated as unsigned and then used in a copying operation. Due to the length underflow, the application will then write outside the bounds of a stack buffer, resulting in a buffer overflow. An attacker must convince a victim to open a document in order to trigger this vulnerability.

• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
• CWE-681Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.