CVE-2017-14538
HighSummary
XnView Classic version 2.40 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to how data from the faulting address controls the subsequent write address.
Risk Assessment
Exploitation of this vulnerability could lead to system compromise or disruption, posing a significant security threat to the organization.
Recommendation
It is recommended to update XnView Classic to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in XnView Classic 2.40
See all- CVE-2017-15789High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a User Mode Write AV concerning CADImage.
- CVE-2017-15788High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a User Mode Write AV concerning CADImage.
- CVE-2017-15787High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a Data Execution Prevention Violation.
- CVE-2017-15786High
XnView Classic version 2.43 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a 'Read Access Violation'.
- CVE-2017-15785High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a Data Execution Prevention Violation near NULL.
- CVE-2017-15784High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to an 'Illegal Instruction Violation'.
- CVE-2017-15783High
XnView Classic version 2.43 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file.
- CVE-2017-15782High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a User Mode Write AV concerning CADImage.
- CVE-2017-15781High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a Read Access Violation on Control Flow.
- CVE-2017-15780High
XnView Classic version 2.43 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a 'Read Access Violation starting at CADImage+0x0000000000285dad.'
Original NVD description (English source)
XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address controls subsequent Write Address starting at jbig2dec+0x0000000000008823."