CVE-2015-6585

Published: Jul 25, 2017Modified: May 13, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by leveraging a "type confusion" via an HWPX file containing a crafted para text tag.

Affected (1)

Products: Hancom: Hangul Word Processor

Hancom

1 product

Hangul Word Processor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hancom Hangul Word Processor	Version 2014

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (8)

http://www.hancom.com/cs_center/csDownload.do

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/76694

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://www.fireeye.com/blog/threat-research/2015/09/zero-day_hwp_exploit.html

Source: cve@mitre.org

Third Party Advisory

https://www.fireeye.com/content/dam/fireeye-www/global/en/blog/threat-research/FireEye_HWP_ZeroDay.pdf

Source: cve@mitre.org

Third Party Advisory

http://www.hancom.com/cs_center/csDownload.do

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/76694

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://www.fireeye.com/blog/threat-research/2015/09/zero-day_hwp_exploit.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.fireeye.com/content/dam/fireeye-www/global/en/blog/threat-research/FireEye_HWP_ZeroDay.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.