PT-2012-3124 · Acd Systems · Acdsee

Published 2012-02-18 · Updated 2017-08-29 · CVE-2012-1197

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ACDSee version 14.1 Build 137

Description The issue is related to an integer overflow in the IDE ACDStd.apl module, which can be triggered by crafted "image dimension values" in a BMP file. This leads to a heap-based buffer overflow, allowing remote attackers to execute arbitrary code.

Recommendations For ACDSee version 14.1 Build 137, consider avoiding the use of the IDE ACDStd.apl module until a patch is available. As a temporary workaround, restrict the processing of BMP files with potentially crafted "image dimension values" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2012-1197

Affected Products

Acdsee

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-1197 · Security Note
• http://secunia.com/advisories/47450 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73242 · Note
• http://osvdb.org/79305 · Note
• http://securityfocus.com/bid/52047 · Note