LizardTech DjVu Browser Plug-in Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	22569
Class:	Boundary Condition Error
CVE:	CVE-2007-0324
Remote:	Yes
Local:	No
Published:	Feb 15 2007 12:00AM
Updated:	Feb 15 2007 04:57PM
Credit:	Brett Moore is credited with the discovery of these vulnerabilities.
Vulnerable:	LizardTech DjVu Browser Plug-in 6.0.1 LizardTech DjVu Browser Plug-in 6.1 LizardTech DjVu Browser Plug-in 6.0
Not Vulnerable:	LizardTech DjVu Browser Plug-in 6.1.1

LizardTech DjVu Browser Plug-in Multiple Buffer Overflow Vulnerabilities

DjVu Browser Plug-in is prone to multiple buffer-overflow vulnerabilities because it fails to sufficiently bounds-check user-supplied data.

Exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the application.

DjVu Browser Plug-in versions prior to 6.1.1 are vulnerable.

LizardTech DjVu Browser Plug-in Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

LizardTech DjVu Browser Plug-in Multiple Buffer Overflow Vulnerabilities

Solution:
The vendor has released version 6.1.1 to address these issues.

LizardTech DjVu Browser Plug-in Multiple Buffer Overflow Vulnerabilities

References:

• DjVu Browser Plug-in Release Notes (LizardTech)
  
• Home Page (LizardTech)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Lizardtech DjVu Browser Plug-in - Multiple Vulnerabilities (Brett Moore )
  
• Vulnerability Note VU#522393 LizardTech DjVu Browser Plug-in buffer overflow vul (US-CERT)