IrfanView Multiple Memory Corruption Vulnerabilities

Bugtraq ID:	45472
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 17 2010 12:00AM
Updated:	Jan 10 2011 03:42PM
Credit:	BraniX via Secunia.
Vulnerable:	IrfanView IrfanView 4.2.2
Not Vulnerable:

IrfanView Multiple Memory Corruption Vulnerabilities

IrfanView is prone to multiple memory-corruption vulnerabilities.

An attacker can exploit these issues to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

IrfanView Multiple Memory Corruption Vulnerabilities

The following proof of concept is available:

• /data/vulnerabilities/exploits/45472.py

IrfanView Multiple Memory Corruption Vulnerabilities

Solution:
Reportedly, the vendor has removed the affected plug-ins in the latest version of the application. Please contact the vendor for more information.

Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IrfanView Multiple Memory Corruption Vulnerabilities

References:

• IrfanView History of changes. (IrfanView)
  
• IrfanView Homepage (IrfanView)