PT-2020-7470 · Xnview · Xnview

Published 2020-01-02 · Updated 2020-01-15 · CVE-2013-3939

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: XnView versions prior to 2.13

Description: The issue arises from the improper handling of RLE strip lengths during the processing of RGB files, allowing remote attackers to execute arbitrary code via the RLE strip size field in a RGB file. This leads to an unexpected sign extension error and a heap-based buffer overflow.

Recommendations: For versions prior to 2.13, update to version 2.13 or later to resolve the issue. As a temporary workaround, consider avoiding the use of xnview.exe for processing RGB files until the update is applied. Restrict access to untrusted RGB files to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2013-3939

Affected Products

Xnview

References · 4

• http://secunia.com/advisories/52101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3939 · Security Note
• http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087 · Vendor Advisory
• https://t.me/cibsecurity/8965 · Telegram Post