jvndb-2023-000031
Vulnerability from jvndb
Published
2023-04-04 15:22
Modified
2024-05-29 17:32
Severity ?
7.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in JustSystems products
Details
Multiple products provided by JustSystems Corporation contain multiple vulnerabilities listed below. <ul><li>Use After Free (CWE-416) - CVE-2022-43664</li> <li>Heap-based Buffer Overflow (CWE-122) - CVE-2022-45115</li> <li>Free of Memory not on the Heap (CWE-590) - CVE-2023-22291</li> <li>Heap-based Buffer Overflow (CWE-122) - CVE-2023-22660</li></ul> Cisco Talos Security Intelligence & Research Group reported these vulnerabilities to JustSystems Corporation and coordinated. JustSystems Corporation and JPCERT/CC published respective advisories in order to notify users of the solutions through JVN.
References
JVN http://jvn.jp/en/jp/JVN79149117/index.html
CVE https://www.cve.org/CVERecord?id=CVE-2022-43664
CVE https://www.cve.org/CVERecord?id=CVE-2022-45115
CVE https://www.cve.org/CVERecord?id=CVE-2023-22291
CVE https://www.cve.org/CVERecord?id=CVE-2023-22660
NVD https://nvd.nist.gov/vuln/detail/CVE-2022-43664
NVD https://nvd.nist.gov/vuln/detail/CVE-2022-45115
NVD https://nvd.nist.gov/vuln/detail/CVE-2023-22291
NVD https://nvd.nist.gov/vuln/detail/CVE-2023-22660
Buffer Errors(CWE-119) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
No Mapping(CWE-Other) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
Impacted products
JustSystems CorporationHanako
JustSystems CorporationHomepage Builder 21
JustSystems CorporationIchitaro
JustSystems CorporationJUST Government
JustSystems CorporationJUST Office
JustSystems CorporationJUST Police
JustSystems CorporationLabel Mighty
JustSystems CorporationRakuraku Hagaki
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000031.html",
  "dc:date": "2024-05-29T17:32+09:00",
  "dcterms:issued": "2023-04-04T15:22+09:00",
  "dcterms:modified": "2024-05-29T17:32+09:00",
  "description": "Multiple products provided by JustSystems Corporation contain multiple vulnerabilities listed below.\r\n\u003cul\u003e\u003cli\u003eUse After Free (CWE-416) - CVE-2022-43664\u003c/li\u003e\r\n\u003cli\u003eHeap-based Buffer Overflow (CWE-122) - CVE-2022-45115\u003c/li\u003e\r\n\u003cli\u003eFree of Memory not on the Heap (CWE-590) - CVE-2023-22291\u003c/li\u003e\r\n\u003cli\u003eHeap-based Buffer Overflow (CWE-122) - CVE-2023-22660\u003c/li\u003e\u003c/ul\u003e\r\nCisco Talos Security Intelligence \u0026 Research Group reported these vulnerabilities to JustSystems Corporation and coordinated. JustSystems Corporation and JPCERT/CC published respective advisories in order to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000031.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:justsystems:hanako",
      "@product": "Hanako",
      "@vendor": "JustSystems Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:justsystems:homepage_builder_21",
      "@product": "Homepage Builder 21",
      "@vendor": "JustSystems Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:justsystems:ichitaro",
      "@product": "Ichitaro",
      "@vendor": "JustSystems Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:justsystems:just_government",
      "@product": "JUST Government",
      "@vendor": "JustSystems Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:justsystems:just_office",
      "@product": "JUST Office",
      "@vendor": "JustSystems Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:justsystems:just_police",
      "@product": "JUST Police",
      "@vendor": "JustSystems Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:justsystems:label_mighty",
      "@product": "Label Mighty",
      "@vendor": "JustSystems Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:justsystems:rakuraku_hagaki",
      "@product": "Rakuraku Hagaki",
      "@vendor": "JustSystems Corporation",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000031",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN79149117/index.html",
      "@id": "JVN#79149117",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-43664",
      "@id": "CVE-2022-43664",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-45115",
      "@id": "CVE-2022-45115",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22291",
      "@id": "CVE-2023-22291",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22660",
      "@id": "CVE-2023-22660",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-43664",
      "@id": "CVE-2022-43664",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-45115",
      "@id": "CVE-2022-45115",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22291",
      "@id": "CVE-2023-22291",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22660",
      "@id": "CVE-2023-22660",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-119",
      "@title": "Buffer Errors(CWE-119)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in JustSystems products"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.