Vulnerabilities > CVE-2009-0197 - Numeric Errors vulnerability in Irfanview Formats 4.00/4.10/4.20
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Integer overflow in the FORMATS Plugin before 4.23 for IrfanView allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large XPM file that triggers a heap-based buffer overflow.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 4 |
Common Weakness Enumeration (CWE)
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 34402 CVE(CAN) ID: CVE-2009-0197 IrfanView是一款快速、免费的图像查看器、浏览器、转换器。 IrfanView的Formats插件在处理设置有某些维度的XPM文件时存在可导致堆溢出的整数溢出漏洞。如果用户受骗打开了特制的XPM文件就可以出发这个溢出,导致以当前用户权限执行任意代码。 IrfanView Formats 4.22 IrfanView --------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://www.irfanview.net/ target=_blank rel=external nofollow>http://www.irfanview.net/</a> |
id | SSV:5021 |
last seen | 2017-11-19 |
modified | 2009-04-10 |
published | 2009-04-10 |
reporter | Root |
title | IrfanView FORMATS插件XPM格式处理整数溢出漏洞 |
References
- http://secunia.com/advisories/34525
- http://secunia.com/secunia_research/2009-20/
- http://www.irfanview.com/plugins.htm
- http://www.osvdb.org/53323
- http://www.securityfocus.com/archive/1/502516/100/0/threaded
- http://www.securityfocus.com/bid/34402
- http://www.vupen.com/english/advisories/2009/0953
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49717