Summary
The TRUMPF products that are listed above contain a vulnerable version of Notepad++. This version isbeing installed for support purposes only, so there is no danger of triggering this vulnerability inNotepad++ during normal operations. Nevertheless, TRUMPF recommends mitigation of thisvulnerability.When editing a specially crafted file containing UTF-8 characters in Notepad++ (Versions up to 8.5.6) and converting that file to UTF-16, a buffer overflow vulnerability can be exploited that allows an attacker to execute arbitrary code to take over the whole system.
Details
Impact
A user who's editing and converting a specially crafted file using the vulnerable Notepad++ version inthe TRUMPF product listed above can allow an attacker to execute code on the local server. This canimpact confidentiality, integrity and availability of information on the affected system.
Mitigation
For additional questions please contact your TRUMPF Service with the PR number 501709.
Remediation
Please download the replacement tool [here](https://trumpf.sharepoint.com/sites/SCC%20Software%20Download%20Portal/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FSCC%20Software%20Download%20Portal%2FShared%20Documents%2FOutgoing%2DFiles%2FSecurity%2FReplaceTools%5FPR501709&p=true&fromShare=true&ga=1).
Vulnerabilities 4
-
High 7.8CVE-2023-40031 Public exploit
Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Read::convert`. This issue may lead to arbitrary code execution. As of time of publication, no known patches are availabl…
-
Medium 5.5
Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneChar
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exploitability of this issue is not clear. Potentially, it may be used to leak int…
-
Medium 5.5
Notepad++ global buffer read overflow in nsCodingStateMachine::NextState
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingStateMachine::NextStater`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal m…
-
Medium 5.5
Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak …
Revision history
-
#2
Fix: quotation mark
-
#1
Initial revision.
References
-
VDE-2024-003: TRUMPF: Multiple products include a vulnerable version of Notepad++ - HTML
https://certvde.com/en/advisories/VDE-2024-003/
-
CERT@VDE Security Advisories for Trumpf SE + Co. KG
https://certvde.com/en/advisories/vendor/trumpf/