Multiple buffer overflows in the rich text processing functionality in JustSystems…
Priority MEDIUM 49CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Multiple buffer overflows in the rich text processing functionality in JustSystems Ichitaro 2004 through 2007, 11 through 13, and other versions allow remote attackers to execute arbitrary code via a long (1) pard field or (2) font name in the fcharset0 field, which is not properly handled in (a) JSTARO4.OCX; or (3) a long title, which is not properly handled by (b) TJSVDA.DLL.
Why it matters now
EPSS 0.05741 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:justsystem:ichitaro:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Justsystem |
| cpe:2.3:a:justsystem:ichitaro:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Justsystem |
| cpe:2.3:a:justsystem:ichitaro:13.0:*:*:*:*:*:*:* | 13.0 | Vulnerable | Justsystem |
| cpe:2.3:a:justsystem:ichitaro:2004:*:*:*:*:*:*:* | 2004 | Vulnerable | Justsystem |
| cpe:2.3:a:justsystem:ichitaro:2005:*:*:*:*:*:*:* | 2005 | Vulnerable | Justsystem |
| cpe:2.3:a:justsystem:ichitaro:2006:*:*:*:*:*:*:* | 2006 | Vulnerable | Justsystem |
| cpe:2.3:a:justsystem:ichitaro:linux:*:*:*:*:*:*:* | linux | Vulnerable | Justsystem |
| cpe:2.3:a:justsystem:ichitaro:lite2:*:*:*:*:*:*:* | lite2 | Vulnerable | Justsystem |
- cpe:2.3:a:justsystem:ichitaro:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Justsystem
- cpe:2.3:a:justsystem:ichitaro:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Justsystem
- cpe:2.3:a:justsystem:ichitaro:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Justsystem
- cpe:2.3:a:justsystem:ichitaro:2004:*:*:*:*:*:*:* Versions 2004 Vulnerable ·Justsystem
- cpe:2.3:a:justsystem:ichitaro:2005:*:*:*:*:*:*:* Versions 2005 Vulnerable ·Justsystem
- cpe:2.3:a:justsystem:ichitaro:2006:*:*:*:*:*:*:* Versions 2006 Vulnerable ·Justsystem
- cpe:2.3:a:justsystem:ichitaro:linux:*:*:*:*:*:*:* Versions linux Vulnerable ·Justsystem
- cpe:2.3:a:justsystem:ichitaro:lite2:*:*:*:*:*:*:* Versions lite2 Vulnerable ·Justsystem
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2007-5687
- 2026-10-03 Alias added: GHSA-5pm4-7676-v58f
References
Advisory 3
More Justsystem Ichitaro vulnerabilities
- TI-2008-00205 Buffer overflow in JustSystems JSFC.DLL, as used in multiple JustSystems products such as… CVSS 2.0HIGH 9.3
- TI-2007-06142 Stack-based buffer overflow in JSGCI.DLL in JustSystems Ichitaro 2005, 2006, and 2007… CVSS 2.0HIGH 9.3
- TI-2006-04179 Stack-based buffer overflow in Justsystem Ichitaro 9.x through 13.x, Ichitaro 2004, 2005… CVSS 2.0HIGH 7.5
- TI-2007-04111 Unspecified vulnerability, possibly a buffer overflow, in Justsystem Ichitaro 2007 and… CVSS 2.0MEDIUM 6.8
- TI-2006-06148 Buffer overflow in JustSystems Hanako 2004 through 2006, Hanako viewer 1.x, Ichitaro… CVSS 2.0MEDIUM 6.8
- TI-2006-05236 Unspecified vulnerability in Justsystem Ichitaro 2006, 2006 trial version, and Government… CVSS 2.0MEDIUM 5.1
Sources
- CVE-2007-5687 · CVE Program
- CVE-2007-5687 · NVD
- FIRST EPSS
- GHSA-5pm4-7676-v58f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences