Tungsten Power PDF JPF Parsing Out-Of-Bounds Write RCE (CVE-2024-9735)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 2. Vulnerability ID: ZDI-24-1365, ZDI-CAN-24451 3. CVE ID: CVE-2024-9735 4. CVSS Score: 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 5. Affected Vendor: Tungsten Automation 6. Affected Product: Power PDF 7. Vulnerability Details: - Remote attackers can exploit this vulnerability to execute arbitrary code on affected Tungsten Automation Power PDF installations. - User interaction is required; the target must access a malicious page or open a malicious file. - The issue lies in the parsing of JPF files, where insufficient validation of user-supplied data leads to out-of-bounds writes beyond the allocated object. - Attackers can leverage this vulnerability to execute code within the context of the current process. 8. Fix Details: Fixed in version 5.1.0.1, which is available for download from the Tungsten download center (https://esd.tungstenautomation.com/Registrations/ChooseLanguage) 9. Disclosure Timeline: - 2024-06-17: Vulnerability reported to vendor - 2024-10-11: Coordinated public disclosure of vulnerability advisory - 2024-10-11: Vulnerability advisory updated 10. Credit: Provided by Mat Powell of Trend Micro Zero Day Initiative. This information helps understand the nature, impact scope, and remediation and disclosure process of the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Tungsten Power PDF JPF Parsing Out-Of-Bounds Write RCE (CVE-2024-9735)