PT-2005-5263 · Xnsoft+1 · Xnview+1

Krzysiek Pawlik · Published 2005-12-31 · Updated 2017-07-20 · CVE-2005-4595

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XnView version 1.70 NView version 4.51

Description The issue is related to an untrusted search path vulnerability, specifically an RPATH vulnerability, which allows local users to execute arbitrary code. This can be achieved by placing a malicious library in the current working directory.

Recommendations For XnView version 1.70, update to a version that fixes the RPATH vulnerability. For NView version 4.51, update to a version that fixes the RPATH vulnerability. As a temporary workaround, consider restricting the execution of libraries from untrusted sources in the current working directory until a patch is available.

Fix

Related Identifiers

CVE-2005-4595

Affected Products

Nview

Xnview

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2005-4595 · Security Note
• http://secunia.com/advisories/18240 · Vendor Advisory
• http://secunia.com/advisories/18235 · Vendor Advisory
• http://securityfocus.com/bid/16087 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23910 · Note
• http://gentoo.org/security/en/glsa/glsa-200512-18.xml · Patch, Vendor Advisory
• http://osvdb.org/22093 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=117063 · Note
• http://osvdb.org/22094 · Note