PT-2018-10764 · Faststone · Faststone Image Viewer

Mostafa Soliman · Published 2018-06-19 · Updated 2018-07-02 · CVE-2018-11705

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FastStone Image Viewer version 6.2

Description The issue occurs when a malformed JPEG file is opened, causing a User Mode Write AV at memory address 0x00578cc4 due to mishandling by FSViewer.exe. This could potentially be exploited for a Denial of Service (DoS) through an Access Violation, or possibly other unspecified impacts.

Recommendations For FastStone Image Viewer version 6.2, consider avoiding the use of FSViewer.exe to open JPEG files from untrusted sources until a fix is available. As a temporary workaround, restrict the handling of JPEG files by FSViewer.exe to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2018-11705

Affected Products

Faststone Image Viewer

References · 3

• 🔥 https://github.com/MostafaSoliman/Security-Advisories/tree/master/CVE-2018-11705 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11705 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11705 · Vendor Advisory