Memory corruption in Justsystem Rakuraku Hagaki
Priority LOW 37CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Memory corruption vulnerability in Rakuraku Hagaki (Rakuraku Hagaki 2018, Rakuraku Hagaki 2017, Rakuraku Hagaki 2016) and Rakuraku Hagaki Select for Ichitaro (Ichitaro 2017, Ichitaro 2016, Ichitaro 2015, Ichitaro Pro3, Ichitaro Pro2, Ichitaro Pro, Ichitaro 2011, Ichitaro Government 8, Ichitaro Government 7, Ichitaro Government 6 and Ichitaro 2017 Trial version) allows attackers to execute arbitrary code with privileges of the application via specially crafted file.
Why it matters now
EPSS 0.01312 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Justsystem | Rakuraku Hagaki | Rakuraku Hagaki 2018; Rakuraku Hagaki 2017; Rakuraku Hagaki 2016 | — | No fix listed | CNA |
| Justsystem | Rakuraku Hagaki Select for Ichitaro | Ichitaro 2017; Ichitaro 2016; Ichitaro 2015; Ichitaro Pro3; Ichitaro Pro2; Ichitaro Pro; Ichitaro 2011; Ichitaro Government 8; Ichitaro Government 7; Ichitaro Government 6; Ichitaro 2017 Trial version | — | No fix listed | CNA |
- Rakuraku Hagaki VendorJustsystem Affected Rakuraku Hagaki 2018; Rakuraku Hagaki 2017; Rakuraku Hagaki 2016 Fixed in — No fix listed CNA
- Rakuraku Hagaki Select for Ichitaro VendorJustsystem Affected Ichitaro 2017; Ichitaro 2016; Ichitaro 2015; Ichitaro Pro3; Ichitaro Pro2; Ichitaro Pro; Ichitaro 2011; Ichitaro Government 8; Ichitaro Government 7; Ichitaro Government 6; Ichitaro 2017 Trial version Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:justsystems:easy_postcard_2016:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:easy_postcard_2017:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:easy_postcard_2018:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_2016:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_2017:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_2017_trial_version:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_2018:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_government_6:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_government_7:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_government_8:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
- cpe:2.3:a:justsystems:easy_postcard_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:easy_postcard_2017:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:easy_postcard_2018:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_2017:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_2017_trial_version:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_2018:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_government_6:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_government_7:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_government_8:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:justsystems:ichitaro_pro:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_pro_2:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_pro_2011:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
| cpe:2.3:a:justsystems:ichitaro_pro_3:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Ichitaro 2023 |
- cpe:2.3:a:justsystems:ichitaro_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_pro_2:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_pro_2011:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
- cpe:2.3:a:justsystems:ichitaro_pro_3:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Ichitaro 2023
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-10870
- 2026-10-03 Alias added: GHSA-7gr8-7r65-qmx7
References
More Justsystem vulnerabilities
- TI-2007-05460 Multiple buffer overflows in the rich text processing functionality in JustSystems… CVSS 2.0HIGH 9.3
- TI-2008-00205 Buffer overflow in JustSystems JSFC.DLL, as used in multiple JustSystems products such as… CVSS 2.0HIGH 9.3
- TI-2007-06142 Stack-based buffer overflow in JSGCI.DLL in JustSystems Ichitaro 2005, 2006, and 2007… CVSS 2.0HIGH 9.3
- TI-2006-04179 Stack-based buffer overflow in Justsystem Ichitaro 9.x through 13.x, Ichitaro 2004, 2005… CVSS 2.0HIGH 7.5
- TI-2007-04111 Unspecified vulnerability, possibly a buffer overflow, in Justsystem Ichitaro 2007 and… CVSS 2.0MEDIUM 6.8
- TI-2006-06148 Buffer overflow in JustSystems Hanako 2004 through 2006, Hanako viewer 1.x, Ichitaro… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2017-10870 · CVE Program
- CVE-2017-10870 · NVD
- FIRST EPSS
- GHSA-7gr8-7r65-qmx7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences