Vulnerability-Lookup

CVE-2017-2155 (GCVE-0-2017-2155)

Vulnerability from cvelistv5 – Published: 2017-04-28 16:00 – Updated: 2024-08-05 13:48

Summary

Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Buffer Overflow

Assigner

jpcert

References

2 references

URL	Tags
http://www.icon-co.jp/news/20170420/index.html	x_refsource_MISC
http://jvn.jp/en/jp/JVN93931029/index.html	third-party-advisoryx_refsource_JVN

Impacted products

5 products

Vendor	Product	Version
ICON CORPORATION	Hoozin Viewer	Affected: Ver2
ICON CORPORATION	Hoozin Viewer	Affected: Ver3
ICON CORPORATION	Hoozin Viewer	Affected: Ver4.1.5.15 and earlier
ICON CORPORATION	Hoozin Viewer	Affected: Ver5.1.2.13 and earlier
ICON CORPORATION	Hoozin Viewer	Affected: Ver6.0.3.09 and earlier

Date Public

2017-04-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:48:04.277Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.icon-co.jp/news/20170420/index.html"
          },
          {
            "name": "JVN#93931029",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN93931029/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver2"
            }
          ]
        },
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver3"
            }
          ]
        },
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver4.1.5.15 and earlier"
            }
          ]
        },
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver5.1.2.13 and earlier"
            }
          ]
        },
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver6.0.3.09 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2017-04-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Buffer Overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-28T15:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.icon-co.jp/news/20170420/index.html"
        },
        {
          "name": "JVN#93931029",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN93931029/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-2155",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Hoozin Viewer",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Ver2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Hoozin Viewer",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Ver3"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Hoozin Viewer",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Ver4.1.5.15 and earlier"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Hoozin Viewer",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Ver5.1.2.13 and earlier"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Hoozin Viewer",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Ver6.0.3.09 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ICON CORPORATION"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.icon-co.jp/news/20170420/index.html",
              "refsource": "MISC",
              "url": "http://www.icon-co.jp/news/20170420/index.html"
            },
            {
              "name": "JVN#93931029",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN93931029/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-2155",
    "datePublished": "2017-04-28T16:00:00.000Z",
    "dateReserved": "2016-12-01T00:00:00.000Z",
    "dateUpdated": "2024-08-05T13:48:04.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-2155",
      "date": "2026-07-22",
      "epss": "0.02547",
      "percentile": "0.83355"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"4.1.5.15\", \"matchCriteriaId\": \"5A3A7338-338A-4C08-AA06-1663A0CD7C5C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"5.1.2.13\", \"matchCriteriaId\": \"3F4C02F0-21D4-46D7-A6B9-35CE6680D0D9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"6.0.3.09\", \"matchCriteriaId\": \"8D78A722-71AF-4992-A6A0-9CB70A6056B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:i.con_corporation:hoozin_viewer:2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F9DD8A38-CA5F-447A-8A7D-1B759F82AF47\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:i.con_corporation:hoozin_viewer:3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"629988EA-58D0-447E-9816-ECE49D121CCA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.\"}, {\"lang\": \"es\", \"value\": \"Desbordamiento de buffer en Hoozin Viewer versiones 2, 3, 4.1.5.15 y anteriores, 5.1.2.13 y anteriores y 6.0.3.09 y anteriores, que permitir\\u00eda a atacantes remotos ejecutar c\\u00f3digo arbitrario a trav\\u00e9s de p\\u00e1ginas web especialmente manipuladas.\"}]",
      "id": "CVE-2017-2155",
      "lastModified": "2024-11-21T03:23:00.073",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2017-04-28T16:59:02.120",
      "references": "[{\"url\": \"http://jvn.jp/en/jp/JVN93931029/index.html\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.icon-co.jp/news/20170420/index.html\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://jvn.jp/en/jp/JVN93931029/index.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.icon-co.jp/news/20170420/index.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "vultures@jpcert.or.jp",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-119\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-2155\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2017-04-28T16:59:02.120\",\"lastModified\":\"2026-05-13T00:24:29.033\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de buffer en Hoozin Viewer versiones 2, 3, 4.1.5.15 y anteriores, 5.1.2.13 y anteriores y 6.0.3.09 y anteriores, que permitir\u00eda a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de p\u00e1ginas web especialmente manipuladas.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.1.5.15\",\"matchCriteriaId\":\"5A3A7338-338A-4C08-AA06-1663A0CD7C5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"5.1.2.13\",\"matchCriteriaId\":\"3F4C02F0-21D4-46D7-A6B9-35CE6680D0D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"6.0.3.09\",\"matchCriteriaId\":\"8D78A722-71AF-4992-A6A0-9CB70A6056B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:i.con_corporation:hoozin_viewer:2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9DD8A38-CA5F-447A-8A7D-1B759F82AF47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:i.con_corporation:hoozin_viewer:3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"629988EA-58D0-447E-9816-ECE49D121CCA\"}]}]}],\"references\":[{\"url\":\"http://jvn.jp/en/jp/JVN93931029/index.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.icon-co.jp/news/20170420/index.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://jvn.jp/en/jp/JVN93931029/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.icon-co.jp/news/20170420/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
  }
}

FKIE_CVE-2017-2155

Vulnerability from fkie_nvd - Published: 2017-04-28 16:59 - Updated: 2026-06-17 01:15

Severity

8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.

References

URL	Tags
vultures@jpcert.or.jp	http://jvn.jp/en/jp/JVN93931029/index.html	Third Party Advisory, VDB Entry
vultures@jpcert.or.jp	http://www.icon-co.jp/news/20170420/index.html	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://jvn.jp/en/jp/JVN93931029/index.html	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.icon-co.jp/news/20170420/index.html	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
i.con_corporation	hoozin_viewer	*
i.con_corporation	hoozin_viewer	*
i.con_corporation	hoozin_viewer	*
i.con_corporation	hoozin_viewer	2
i.con_corporation	hoozin_viewer	3

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver2"
            }
          ]
        },
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver3"
            }
          ]
        },
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver4.1.5.15 and earlier"
            }
          ]
        },
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver5.1.2.13 and earlier"
            }
          ]
        },
        {
          "product": "Hoozin Viewer",
          "vendor": "ICON CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "Ver6.0.3.09 and earlier"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A3A7338-338A-4C08-AA06-1663A0CD7C5C",
              "versionEndIncluding": "4.1.5.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F4C02F0-21D4-46D7-A6B9-35CE6680D0D9",
              "versionEndIncluding": "5.1.2.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D78A722-71AF-4992-A6A0-9CB70A6056B7",
              "versionEndIncluding": "6.0.3.09",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:i.con_corporation:hoozin_viewer:2:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9DD8A38-CA5F-447A-8A7D-1B759F82AF47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:i.con_corporation:hoozin_viewer:3:*:*:*:*:*:*:*",
              "matchCriteriaId": "629988EA-58D0-447E-9816-ECE49D121CCA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de buffer en Hoozin Viewer versiones 2, 3, 4.1.5.15 y anteriores, 5.1.2.13 y anteriores y 6.0.3.09 y anteriores, que permitir\u00eda a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de p\u00e1ginas web especialmente manipuladas."
    }
  ],
  "id": "CVE-2017-2155",
  "lastModified": "2026-06-17T01:15:39.307",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-04-28T16:59:02.120",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://jvn.jp/en/jp/JVN93931029/index.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.icon-co.jp/news/20170420/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://jvn.jp/en/jp/JVN93931029/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.icon-co.jp/news/20170420/index.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-JGJC-X54W-86J6

Vulnerability from github – Published: 2022-05-17 02:46 – Updated: 2022-05-17 02:46

Details

Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.

Severity

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-2155"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-28T16:59:00Z",
    "severity": "HIGH"
  },
  "details": "Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.",
  "id": "GHSA-jgjc-x54w-86j6",
  "modified": "2022-05-17T02:46:54Z",
  "published": "2022-05-17T02:46:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2155"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN93931029/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.icon-co.jp/news/20170420/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2017-2155

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.

Aliases

CVE-2017-2155

Aliases

CVE-2017-2155

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-2155",
    "description": "Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.",
    "id": "GSD-2017-2155"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-2155"
      ],
      "details": "Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.",
      "id": "GSD-2017-2155",
      "modified": "2023-12-13T01:21:06.021568Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2017-2155",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Hoozin Viewer",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Ver2"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Hoozin Viewer",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Ver3"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Hoozin Viewer",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Ver4.1.5.15 and earlier"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Hoozin Viewer",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Ver5.1.2.13 and earlier"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Hoozin Viewer",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Ver6.0.3.09 and earlier"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "ICON CORPORATION"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Buffer Overflow"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.icon-co.jp/news/20170420/index.html",
            "refsource": "MISC",
            "url": "http://www.icon-co.jp/news/20170420/index.html"
          },
          {
            "name": "JVN#93931029",
            "refsource": "JVN",
            "url": "http://jvn.jp/en/jp/JVN93931029/index.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:i.con_corporation:hoozin_viewer:3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.1.2.13",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.0.3.09",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:i.con_corporation:hoozin_viewer:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.1.5.15",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:i.con_corporation:hoozin_viewer:2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-2155"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.icon-co.jp/news/20170420/index.html",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.icon-co.jp/news/20170420/index.html"
            },
            {
              "name": "JVN#93931029",
              "refsource": "JVN",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://jvn.jp/en/jp/JVN93931029/index.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2017-05-06T00:11Z",
      "publishedDate": "2017-04-28T16:59Z"
    }
  }
}

JVNDB-2017-000075

Vulnerability from jvndb - Published: 2017-04-20 14:48 - Updated:2017-06-01 13:40

Severity

5.0 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Summary

Hoozin Viewer vulnerable to buffer overflow

Details

Hoozin Viewer provided by ICON CORPORATION contains a buffer overflow vulnerability (CWE-121). Touma Hatano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN93931029/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2155
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2017-2155
	Buffer Errors(CWE-119)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

ICON CORPORATION

Hoozin Viewer

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000075.html",
  "dc:date": "2017-06-01T13:40+09:00",
  "dcterms:issued": "2017-04-20T14:48+09:00",
  "dcterms:modified": "2017-06-01T13:40+09:00",
  "description": "Hoozin Viewer provided by ICON CORPORATION contains a buffer overflow vulnerability (CWE-121).\r\n\r\nTouma Hatano reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000075.html",
  "sec:cpe": {
    "#text": "cpe:/a:i.con_corporation:hoozin_viewer",
    "@product": "Hoozin Viewer",
    "@vendor": "ICON CORPORATION",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.1",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000075",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN93931029/index.html",
      "@id": "JVN#93931029",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2155",
      "@id": "CVE-2017-2155",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2155",
      "@id": "CVE-2017-2155",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-119",
      "@title": "Buffer Errors(CWE-119)"
    }
  ],
  "title": "Hoozin Viewer vulnerable to buffer overflow"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2017-2155 (GCVE-0-2017-2155)

FKIE_CVE-2017-2155

GHSA-JGJC-X54W-86J6

GSD-2017-2155

JVNDB-2017-000075

Tags

Sightings

Nomenclature