PT-2007-1089 · Xnview · Xnview

Marsu · Published 2007-04-24 · Updated 2017-10-11 · CVE-2007-2194

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: XnView versions 1.90.3 XnView versions prior to 1.70

Description: The issue is related to a stack-based buffer overflow that allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.

Recommendations: For XnView version 1.90.3, update to a version that fixes the stack-based buffer overflow issue. For XnView versions prior to 1.70, update to a version that fixes the stack-based buffer overflow issue. As a temporary workaround, consider avoiding the use of crafted XPM files with long section strings until a patch is available.

Exploit

Fix

Related Identifiers

BDU:2015-09573

CVE-2007-2194

Affected Products

Xnview

References · 11

• 🔥 https://exploit-db.com/exploits/3777 · Exploit
• http://security.gentoo.org/glsa/glsa-200707-06.xml · Vendor Advisory
• http://secunia.com/advisories/24973 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09573 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-2194 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33810 · Note
• http://securityfocus.com/bid/23625 · Note
• http://vupen.com/english/advisories/2007/1488 · Note
• http://osvdb.org/35235 · Note
• http://secunia.com/advisories/26006 · Note
• http://xforce.iss.net/xforce/xfdb/33810 · Note