Design/Logic Flaw

IrfanView version 4.44 32bit allows remote attackers to execute code via a crafted .mov file, because of a "User Mode Write AV near NULL" issue...

Code injection

In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a "User Mode Write AV starting at image0000000000400000+0x000000000001b72a."...

Code injection

XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to a "User Mode Write AV starting at Xfpx+0x000000000000dcab."...

CVE-2017-10747

XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at xnview+0x000000000037a8aa."...

CVE-2017-10750

XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV near NULL starting at ntdll77df0000!RtlEnterCriticalSection+0x0000000000000012."...

CVE-2017-10748

XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at xnview+0x000000000022bf8d."...

CVE-2017-8826

FastStone Image Viewer 6.2 is affected by a vulnerability described as a “User Mode Write AV” that can be triggered by processing a malformed JPEG file. The issue is linked to the jpeg_mem_term function in jmemnobs.c of libjpeg and can be exploited by a malformed JPEG that causes an access violat...

CVE-2017-9534

IrfanView version 4.44 32bit with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX!GetPlugInInfo+0x0000000000017426."...

CVE-2017-7894

WinDjView 2.1 is affected by CVE-2017-7894. The vulnerability arises from a User Mode Write AV near NULL in WinDjView.exe, enabling code execution when a user opens a crafted .djvu file. Affected scenario involves a victim obtaining an untrusted .djvu from a remote source and issuing several user...

CVE-2017-9531

CVE-2017-9531 affects IrfanView 4.44 (32‑bit) with FPX Plugin 4.46. A crafted FPX file can trigger a user‑mode write/overflow, leading to arbitrary code execution or a denial of service. Connected sources corroborate a FPX‑related buffer/AV condition in multiple advisories (CNVD-2017-14128; Kaspe...

CVE-2017-10737

XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at ntdll77df0000!RtlpCoalesceFreeBlocks+0x00000000000002e6."...

CVE-2017-8826

FastStone Image Viewer 6.2 has a "User Mode Write AV" issue, possibly related to the jpegmemterm function in jmemnobs.c in libjpeg. This issue can be triggered by a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS Access Violation or possibly...

CVE-2017-10736

XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at msvcrt!VECmemzero+0x000000000000006a."...

CVE-2017-9925

In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x000000000000001d."...

SumatraPDF 2.1.1/MuPDF 1.0 Integer Overflow

No description provided by source. Sumatra 2.1.1/MuPDF 1.0 Integer Overflow ======================================= There is an integer overflow on the MuPDF in the lexnumber function which can be triggered using a corrupt PDF file with ObjStm. I'm attaching a file that reproduces the problem wit...

VideoLAN VLC Media Player 2.1.3 - '.avs' Crash (PoC)

Exploit Title: VLC 2.1.3 WriteAV Vulnerability, Decoders Date: 2014/02/20 Exploit Author: kw4 Software Link: http://www.videolan.org/vlc/index.html Version: 2.1.3 Impact Med/High Tested on: Windows 7 64 bits Memory corruption when VLC tries to load crafted .avs files. 2b10.2750: Access violation ...

Nitro Pro 8.0.3.1 - Crash (PoC)

Nitro Pro 8.0.3.1 - Crash PoC !C:\Python27\python.exe Exploit Title: Nitro Pro 8.0.3.1 - DoS Date: 2012-10-07 Exploit Author: John Cobb Author Homepage: www.NoBytes.com Vendor Homepage: www.nitropdf.com Version: 8.0.3.1 Tested on: Win7 64bit CVE : None When the Object Index exceeds 10 characters...

SumatraPDF 2.1.1MuPDF 1.0 - Integer Overflow

SumatraPDF 2.1.1MuPDF 1.0 - Integer Overflow Sumatra 2.1.1/MuPDF 1.0 Integer Overflow ======================================= There is an integer overflow on the MuPDF in the lexnumber function which can be triggered using a corrupt PDF file with ObjStm. I'm attaching a file that reproduces the...

Microsoft Office Picture Manager 2010 - Crash (PoC)

Title : Microsoft Office Picture Manager 2010 memory corruption Version : Microsoft Office professional Plus 2010 Crash : http://img715.imageshack.us/img715/7364/pocl.png Date : 2012-10-24 Vendor : http://office.microsoft.com Impact : Med/High Contact : coolkaveh at rocketmail.com Twitter :...

Vulnerability in Foxit Reader Could Allow Arbitrary Code Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Foxit Reader software version 5.1.4.0104 and earlier. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor, Foxit...