CVE-2017-10954
HighSummary
CVE-2017-10954 allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018 prior to build 7.72918. User interaction is required to exploit this vulnerability, meaning the target must visit a malicious page or open a malicious file.
Risk Assessment
Exploitation of this vulnerability could lead to system takeover with SYSTEM privileges, posing a serious security threat to the organization.
Recommendation
It is recommended to update Bitdefender Internet Security to version 7.72918 or later to mitigate this vulnerability. Additionally, users should be warned against opening suspicious files and visiting unknown websites.
Other vulnerabilities in Bitdefender Internet Security 2018
See all- CVE-2017-17410High
CVE-2017-17410 allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability, meaning the target must visit a malicious page or open a malicious file.
- CVE-2017-17409High
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
- CVE-2017-17408High
CVE-2017-17408 allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability, meaning the target must visit a malicious page or open a malicious file.
Original NVD description (English source)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet Security 2018 prior to build 7.72918. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within pdf.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-4361.