In the majority of cases, InCopy will close the file before the user has a chance to open it. This prevents InCopy from being exploited. However, in the event that a user were to open a malicious file, an attacker could leverage other vulnerabilities to exploit InCopy.
CVE-2018-5704: Heap-Based Buffer Overflow in InCopy v17.3 and Earlier
In the majority of cases, InCopy will close the file before the user has a chance to open it. This prevents InCopy from being exploited. However, in the event that a user were to open a malicious file, an attacker could leverage other vulnerabilities to exploit InCopy.
CVE-2019-5705: InCopy Servements with PHP/5.5.40 or Earlier Vulnerabilities
InCopy version 17.3 (and earlier) and 16.4.2 (and earlier) are affected by a Server Side Request Forgery (SSRF) vulnerability that could allow an attacker to execute script on the targeted system in the context of the current user.
In order to exploit this issue, an attacker must entice a user to click on a malicious link.
CVE-2019-5706: InCopy XMPP Server Vulnerabilities
InCopy version 17.3 (and earlier) and 16.4.2 (and earlier) are affected by a XMPP Overflow vulnerability that could allow an attacker to execute
Dependencies
A CVE number is used to uniquely identify each published vulnerability.
Timeline
Published on: 09/16/2022 18:15:00 UTC
Last modified on: 09/20/2022 17:44:00 UTC