PT-2010-3184 · Irfanview · Irfanview

Publicado 2010-05-14 · Atualizado 2018-10-10 · CVE-2010-1509

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions IrfanView versions prior to 4.27

Description The issue is related to the improper handling of an unspecified integer variable during the processing of PSD images. This can be exploited by remote attackers using a crafted image file, potentially triggering a heap-based buffer overflow due to a sign-extension error. The exploitation can lead to a denial of service, causing the application to crash, or possibly allow the execution of arbitrary code.

Recommendations For versions prior to 4.27, update to version 4.27 or later to resolve the issue.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-1509

Produtos afetados

Irfanview

Referências · 9

• http://securityfocus.com/bid/40104 · Nota
• http://irfanview.com/main_history.htm · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58548 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6705 · Nota
• http://securityfocus.com/archive/1/511274/100/0/threaded · Nota
• http://secunia.com/advisories/39036 · Aviso do Fabricante
• http://osvdb.org/64627 · Nota
• http://secunia.com/secunia_research/2010-41 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-1509 · Nota de Segurança