PT-2024-23719 · Irfanview · Irfanview

Leeho + 2 · Published 2024-10-21 · Updated 2024-10-23 · CVE-2024-31007

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IrfanView 32bit version 4.66

Description A Buffer Overflow issue allows a local attacker to cause a denial of service via a crafted file, affecting the IrfanView 32bit component with the plugin formats.dll.

Recommendations For IrfanView 32bit version 4.66, consider disabling the formats.dll plugin as a temporary workaround until a patch is available. Restrict access to potentially crafted files to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-31007

Affected Products

Irfanview

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-31007 · Security Note
• https://fosshub.com/IrfanView.html?dwl=iview466_setup.exe · Note
• https://twitter.com/CVEnew/status/1849046769025618127 · Twitter Post
• https://mediaside.net/irfanview-italia/2024/04/12/4-67-data-di-rilascio-5-aprile-2024 · Note
• https://github.com/kirito999/IrfanViewBug · Note
• https://fosshub.com/IrfanView.html?dwl=iview466_plugins.zip · Note