TRUMPF: Multiple products include a vulnerable version of Notepad++
The TRUMPF products that are listed above contain a vulnerable version of Notepad++. This version isbeing installed for support purposes only, so there is no danger of triggering this vulnerability inNotepad++ during normal operations. Nevertheless, TRUMPF recommends mitigation of thisvulnerability.When editing a specially crafted file containing UTF-8 characters in Notepad++ (Versions up to 8.5.6) and converting that file to UTF-16, a buffer overflow vulnerability can be exploited that allows an attacker to execute arbitrary code to take over the whole system.
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-40166US | medium5.5 | — | ||
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The… | ||||
| CVE-2023-40164US | medium5.5 | — | ||
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingStateMachine::NextStater`. The exploitabi… | ||||
| CVE-2023-40036US | medium5.5 | — | ||
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exp… | ||||
| CVE-2023-40031US | high7.8 | Exploit | ||
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Read::convert`. This issue may lead to arb… | ||||
references
External citations — patches, advisories, analysis.
remediations (8)
- Mitigation
For additional questions please contact your TRUMPF Service with the PR number 501709.
- Mitigation
For additional questions please contact your TRUMPF Service with the PR number 501709.
- Mitigation
For additional questions please contact your TRUMPF Service with the PR number 501709.
- Mitigation
For additional questions please contact your TRUMPF Service with the PR number 501709.
- Fixed
Please download the replacement tool [here](https://trumpf.sharepoint.com/sites/SCC%20Software%20Download%20Portal/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FSCC%20Software%20Download%20Portal%2FShared%20Documents%2FOutgoing%2DFiles%2FSecurity%2FReplaceTools%5FPR501709&p=true&fromShare=true&ga=1).
- Fixed
Please download the replacement tool [here](https://trumpf.sharepoint.com/sites/SCC%20Software%20Download%20Portal/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FSCC%20Software%20Download%20Portal%2FShared%20Documents%2FOutgoing%2DFiles%2FSecurity%2FReplaceTools%5FPR501709&p=true&fromShare=true&ga=1).
- Fixed
Please download the replacement tool [here](https://trumpf.sharepoint.com/sites/SCC%20Software%20Download%20Portal/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FSCC%20Software%20Download%20Portal%2FShared%20Documents%2FOutgoing%2DFiles%2FSecurity%2FReplaceTools%5FPR501709&p=true&fromShare=true&ga=1).
- Fixed
Please download the replacement tool [here](https://trumpf.sharepoint.com/sites/SCC%20Software%20Download%20Portal/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FSCC%20Software%20Download%20Portal%2FShared%20Documents%2FOutgoing%2DFiles%2FSecurity%2FReplaceTools%5FPR501709&p=true&fromShare=true&ga=1).
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan