{"lastseen": "2017-11-19T16:05:51", "modified": "2014-07-01T00:00:00", "description": "No description provided by source.", "cvss": {"score": 0.0, "vector": "NONE"}, "published": "2014-07-01T00:00:00", "status": "poc", "enchantments": {"score": {"value": 7.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 7.1}, "href": "https://www.seebug.org/vuldb/ssvid-73128", "references": [], "enchantments_done": [], "id": "SSV:73128", "title": "XnView RAS Image Processing Heap Overflow", "bulletinFamily": "exploit", "reporter": "Root", "cvelist": [], "viewCount": 17, "sourceData": "\n #####################################################################################\r\n\r\nApplication: XnView RAS Image Processing Heap Overflow\r\nPlatforms: Windows \r\n\r\nSecunia: SA49091 \r\n\r\n{PRL}: 2012-14\r\n\r\nAuthor: Francis Provencher (Protek Research Lab's) \r\n\r\nWebsite: http://www.protekresearchlab.com/\r\n\r\nTwitter: @ProtekResearch\r\n\r\n\r\n#####################################################################################\r\n\r\n1) Introduction\r\n2) Report Timeline\r\n3) Technical details\r\n4) The Code\r\n\r\n\r\n#####################################################################################\r\n\r\n===============\r\n1) Introduction\r\n===============\r\nXnView is a cross-platform image viewer used for viewing, converting, organising and editing graphical & video files.\r\nIt is free of charge for private, educational and non-profit organisations. For commercial use and distribution,\r\nthe user must register the program. It is popular with users as it provides features normally found only\r\nin commercial image viewers.\r\n\r\n(http://en.wikipedia.org/wiki/XnView)\r\n\r\n#####################################################################################\r\n\r\n============================\r\n2) Report Timeline\r\n============================ \r\n\r\n2012-05-15 Vulnerability reported to Secunia\r\n2012-06-15 Vendor disclose patch\r\n\r\n\r\n#####################################################################################\r\n\r\n============================\r\n3) Technical details\r\n============================\r\nAn integer truncation error when processing Sun Raster images can be exploited\r\nto cause a heap-based buffer overflow via a specially crafted "Depth" value in a RAS file.\r\n\r\n#####################################################################################\r\n\r\n===========\r\n4) The Code\r\n===========\r\n\r\nhttp://www.protekresearchlab.com/exploits/PRL-2012-14.ras\r\nhttp://www.exploit-db.com/sploits/19181.ras\r\n\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-73128", "type": "seebug", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645296382, "score": 1698834387, "epss": 1678850553}, "_internal": {"score_hash": "bc1b0eabd3930b7867c107a90098f18c"}}
XnView RAS Image Processing Heap Overflow