XnView 1.98.8 - '.tiff' Image Processing Heap Overflow (1)
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | CVE-2012-0276 | 22 Jun 201200:00 | – | circl |
 | CVE-2012-0276 | 17 Jul 201221:00 | – | cve |
 | CVE-2012-0276 | 17 Jul 201221:00 | – | cvelist |
 | XnView 1.98.8 - '.tiff' Image Processing Heap Overflow (2) | 22 Jun 201200:00 | – | exploitdb |
 | CVE-2012-0276 | 17 Jul 201221:55 | – | nvd |
 | XnView Multiple Image Decompression Heap Overflow Vulnerabilities - Windows | 24 Jul 201200:00 | – | openvas |
| XnView Multiple Image Decompression Heap Overflow Vulnerabilities (Windows) | 24 Jul 201200:00 | – | openvas |
 | Heap overflow | 17 Jul 201221:55 | – | prion |
 | XnView < 1.99.0 Multiple Buffer Overflow Vulnerabilities | 20 Jun 201200:00 | – | nessus |
#####################################################################################
Application: XnView TIFF Image Processing Heap Overflow
Platforms: Windows
Secunia: SA48666
{PRL}: 2012-16
Author: Francis Provencher (Protek Research Lab's)
Website: http://www.protekresearchlab.com/
Twitter: @ProtekResearch
#####################################################################################
1) Introduction
2) Report Timeline
3) Technical details
4) The Code
#####################################################################################
===============
1) Introduction
===============
XnView is a cross-platform image viewer used for viewing, converting, organising and editing graphical & video files.
It is free of charge for private, educational and non-profit organisations. For commercial use and distribution,
the user must register the program. It is popular with users as it provides features normally found only
in commercial image viewers.
(http://en.wikipedia.org/wiki/XnView)
#####################################################################################
============================
2) Report Timeline
============================
2012-05-15 Vulnerability reported to Secunia
2012-06-21 Vendor disclose patch
#####################################################################################
============================
3) Technical details
============================
Insufficient validation when decompressing SGI32LogLum compressed TIFF
images where the PhotometricInterpretation encoding is set to LogL can
be exploited to cause a heap-based buffer overflow.
The vulnerabilities are confirmed in version 1.98.8. Other versions may also be affected
#####################################################################################
===========
4) The Code
===========
http://protekresearchlab.com/exploits/PRL-2012-16.tiff
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19337.tiffData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Jun 2012 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 26.8
EPSS0.08319