CVE-2019-12828
High · 8.8CVSS
8.8
EPSS
13.3%
Published
Jun 14, 2019
CISA due date
—
The record
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2019-0946 A remote code execution vulnerability exists when the Microsoft Office Access… CWE-19
- CVE-2019-0947 A remote code execution vulnerability exists when the Microsoft Office Access… CWE-19
- CVE-2019-0945 A remote code execution vulnerability exists when the Microsoft Office Access… CWE-19
- CVE-2019-0801 A remote code execution vulnerability exists when Microsoft Office fails to properly… CWE-19
- CVE-2019-0630 A remote code execution vulnerability exists in the way that the Microsoft Server Message… CWE-19
- CVE-2019-0633 A remote code execution vulnerability exists in the way that the Microsoft Server Message… CWE-19
- CVE-2009-5155 In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c… CWE-19
- CVE-2012-5357 Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform… CWE-19