Remote Code Execution Flaw in MrSID Plugin for IrfanView
CVE-2013-3945

7.8HIGH

Key Information:

Vendor

Irfanview
Status
Mrsid Plugin
Vendor
CVE Published:
2 January 2020

What is CVE-2013-3945?

The MrSID plugin for IrfanView, prior to version 4.37, is susceptible to a remote code execution vulnerability due to improper handling of nband tags. This flaw could permit remote attackers to execute arbitrary code on a vulnerable system, potentially leading to unauthorized access and the execution of malicious payloads. Users of affected versions are highly encouraged to update to the latest release to mitigate this risk.

Affected Version(s)

MrSID plugin before 4.37

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/89805
x_refsource_MISC
https://www.irfanview.com/history_old.htm
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.