PT-2013-4427 · Sagelight · Sagelight

Published 2013-08-09 · Updated 2017-08-29 · CVE-2013-3480

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sagelight versions 4.4 and earlier

Description The issue is related to an integer overflow that allows remote attackers to execute arbitrary code. This is achieved by crafting specific width and height dimensions in a BMP file, which in turn triggers a heap-based buffer overflow.

Recommendations For Sagelight versions 4.4 and earlier, update to a version later than 4.4 to resolve the issue.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2013-3480

Affected Products

Sagelight

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-3480 · Security Note
• http://secunia.com/advisories/52705 · Vendor Advisory
• http://securityfocus.com/bid/61408 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85920 · Note