CVE-2012-0282
medium
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8
Description
Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted ImageLeftPosition value in an ImageDescriptor structure in a GIF image.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: PSIRT-CNA@flexerasoftware.com — http://secunia.com/advisories/48666
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| xnview | xnview | {"endIncluding":"1.98.8"} | |
References
- http://newsgroup.xnview.com/viewtopic.php?f=35&t=25858
- http://secunia.com/advisories/48666
- http://www.exploit-db.com/exploits/19335
- http://www.osvdb.org/83086
- http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=51
- http://newsgroup.xnview.com/viewtopic.php?f=35&t=25858
- http://secunia.com/advisories/48666
- http://www.exploit-db.com/exploits/19335
- http://www.osvdb.org/83086
- http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=51
CWEs
CWE-119
Verify integrity in audit chain (admin only). AS-IS.