Remote Code Execution Vulnerability in IrfanView with FlashPix Plugin
CVE-2017-8370

7.8HIGH

Key Information:

Vendor

Irfanview
Status
Fpx
Irfanview
Vendor
CVE Published:
5 July 2017

What is CVE-2017-8370?

A vulnerability exists in IrfanView version 4.44 (32bit) that, when exploited through the FlashPix (.FPX) plugin version 4.45, allows remote attackers to execute arbitrary code. This could lead to denial of service situations due to heap corruption and application crashes when processing specially crafted .FPX files, thereby compromising the integrity and availability of the application.

References

http://www.irfanview.com/plugins.htm
x_refsource_CONFIRM
https://github.com/wlinzi/security_advisories/tree/master...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.