Heap-Based Buffer Overflow in XnView from XnSoft
CVE-2013-3937

7.8HIGH

Key Information:

Vendor

Xnview

Status
Xnview
Vendor
CVE Published:
2 January 2020

What is CVE-2013-3937?

A heap-based buffer overflow vulnerability exists in XnView prior to version 2.13, enabling remote attackers to execute arbitrary code. This occurs through manipulation of the biBitCount field in a specially crafted BMP file, potentially allowing for unauthorized access and exploitation. Users are advised to update to the latest version to mitigate risks associated with this vulnerability.

Affected Version(s)

XnView before 2.13

References

http://secunia.com/advisories/52101
third-party-advisoryx_refsource_SECUNIA
http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.