IrfanView ANI File Integer Overflow Vulnerability

Bugtraq ID:	61000
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 03 2013 12:00AM
Updated:	Jul 03 2013 12:00AM
Credit:	FuzzMyApp
Vulnerable:	IrfanView IrfanView 4.35
Not Vulnerable:	IrfanView IrfanView 4.36

IrfanView ANI File Integer Overflow Vulnerability

IrfanView is prone to an integer-overflow vulnerability.

Successful exploits allow remote attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in denial-of-service conditions. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

IrfanView 4.35 is vulnerable; other versions may also be affected.

IrfanView ANI File Integer Overflow Vulnerability

An attacker can exploit this issue using readily available tools.

IrfanView ANI File Integer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IrfanView ANI File Integer Overflow Vulnerability

References:

• IrfanView 4.35 - ANI (Windows Animated Cursor Format) Heap Overflow Vulnerabilit (FuzzMyApp)
  
• IrfanView Homepage (irfan skiljan)
  
• Version 4.36 ( - CURRENT VERSION - ) (Release date: 2013-06-27) (irfan skiljan)