CVE-2013-3928

2014-03-1119:37:02

CWE-119

[email protected]

web.nvd.nist.gov

cve-2013-3928

chasys draw ies

buffer overflow

readfile function

flt_bmp.dll

nvd

security vulnerability

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.2 High

AI Score

Confidence

Low

0.95 High

EPSS

Percentile

99.3%

JSON

Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote attackers to execute arbitrary code via crafted biPlanes and biBitCount fields in a BMP file.

Affected configurations

NVD

Node

jpchachachasys_draw_iesRange≤4.10.01

jpchachachasys_draw_iesMatch4.00.01

jpchachachasys_draw_iesMatch4.01.01

jpchachachasys_draw_iesMatch4.02.01

jpchachachasys_draw_iesMatch4.03.02

jpchachachasys_draw_iesMatch4.04.01

jpchachachasys_draw_iesMatch4.06.02

CPENameOperatorVersion
jpchacha:chasys_draw_iesjpchacha chasys draw iesle4.10.01
jpchacha:chasys_draw_iesjpchacha chasys draw ieseq4.00.01
jpchacha:chasys_draw_iesjpchacha chasys draw ieseq4.01.01
jpchacha:chasys_draw_iesjpchacha chasys draw ieseq4.02.01
jpchacha:chasys_draw_iesjpchacha chasys draw ieseq4.03.02
jpchacha:chasys_draw_iesjpchacha chasys draw ieseq4.04.01
jpchacha:chasys_draw_iesjpchacha chasys draw ieseq4.06.02

CPE	Name	Operator	Version
jpchacha:chasys_draw_ies	jpchacha chasys draw ies	le	4.10.01
jpchacha:chasys_draw_ies	jpchacha chasys draw ies	eq	4.00.01
jpchacha:chasys_draw_ies	jpchacha chasys draw ies	eq	4.01.01
jpchacha:chasys_draw_ies	jpchacha chasys draw ies	eq	4.02.01
jpchacha:chasys_draw_ies	jpchacha chasys draw ies	eq	4.03.02
jpchacha:chasys_draw_ies	jpchacha chasys draw ies	eq	4.04.01
jpchacha:chasys_draw_ies	jpchacha chasys draw ies	eq	4.06.02