CVE-2022-41642

Name of the Vulnerable Software and Affected Versions Nadesiko3 (PC Version) versions 3.3.61 and earlier Nadesiko3 (PC Version) versions 3.3.68 and earlier

Description The issue allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product. Release notes for versions 3.3.62 and 3.3.69 link to patches for this issue, and the JPCERT/CC advisory lists versions 3.3.68 and prior as vulnerable, with the most recent patch tagged with version 3.3.69.

Recommendations For versions 3.3.61 and earlier, update to version 3.3.69 or later to resolve the issue. For versions 3.3.62 through 3.3.68, update to version 3.3.69 or later to resolve the issue. As a temporary workaround, consider restricting access to compression and decompression functionality until a patch is applied.