PT-2012-3124 · Acd Systems · Acdsee

Publicado 2012-02-18 · Atualizado 2017-08-29 · CVE-2012-1197

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ACDSee version 14.1 Build 137

Description The issue is related to an integer overflow in the IDE ACDStd.apl module, which can be triggered by crafted "image dimension values" in a BMP file. This leads to a heap-based buffer overflow, allowing remote attackers to execute arbitrary code.

Recommendations For ACDSee version 14.1 Build 137, consider avoiding the use of the IDE ACDStd.apl module until a patch is available. As a temporary workaround, restrict the processing of BMP files with potentially crafted "image dimension values" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2012-1197

Produtos afetados

Acdsee

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-1197 · Nota de Segurança
• http://secunia.com/advisories/47450 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73242 · Nota
• http://osvdb.org/79305 · Nota
• http://securityfocus.com/bid/52047 · Nota