CVE-2017-2783
HighSummary
A heap corruption vulnerability exists in the FillRowFormat functionality of Antenna House DMC HTMLFilter shipped with MarkLogic 8.0-6. A specially crafted xls file can cause heap corruption leading to arbitrary code execution.
Risk Assessment
This vulnerability can be exploited by an attacker to execute malicious code on the server, posing a significant security risk to the system.
Recommendation
It is recommended to upgrade to the latest version of MarkLogic to mitigate this vulnerability and to monitor xls files being uploaded to the system.
Other vulnerabilities in Antenna House DMC HTMLFilter w MarkLogic 8.0-6
See all- CVE-2017-2798High
A heap corruption vulnerability exists in the GetIndexArray functionality of Antenna House DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted XLS file can cause a heap corruption resulting in arbitrary code execution.
- CVE-2017-2793High
A heap corruption vulnerability exists in the UnCompressUnicode functionality of Antenna House DMC HTMLFilter used by MarkLogic 8.0-6. A specially crafted XLS file can cause heap corruption leading to arbitrary code execution.
Original NVD description (English source)
An exploitable heap corruption vulnerability exists in the FillRowFormat functionality of Antenna House DMC HTMLFilter that is shipped with MarkLogic 8.0-6. A specially crafted xls file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide malicious xls file to trigger this vulnerability.