CVE-2017-14297
HighSummary
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to code flow control from a faulting address.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized system access or disruption of service, posing a serious security threat to the organization.
Recommendation
It is recommended to update STDU Viewer to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity related to .jb2 files.
Other vulnerabilities in STDU Viewer 1.6.375
See all- CVE-2017-14692High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue is related to a user mode write AV in the DllGetClassObject function.
- CVE-2017-14691High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file.
- CVE-2017-14690High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to faulting address controls affecting subsequent write addresses.
- CVE-2017-14689High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file. The issue relates to the use of data from a faulting address as arguments in subsequent function calls.
- CVE-2017-14688High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, related to a 'Read Access Violation'.
- CVE-2017-14579High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a 'Read Access Violation on Control Flow'.
- CVE-2017-14577High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue is related to a Read Access Violation on Control Flow.
- CVE-2017-14576High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, potentially leading to stack corruption.
- CVE-2017-14575High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue is related to an 'Illegal Instruction' violation concerning an unknown symbol.
- CVE-2017-14574High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a 'User Mode Write AV'.
Original NVD description (English source)
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address controls Code Flow starting at STDUJBIG2File!DllGetClassObject+0x0000000000002f35."