CVE-2017-14545
HighSummary
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file.
Risk Assessment
The organization may be exposed to service outages and other unforeseen consequences related to processing malicious files.
Recommendation
It is recommended to update STDU Viewer to the latest version and to monitor .epub files before opening them.
Other vulnerabilities in STDU Viewer 1.6.375
See all- CVE-2017-14692High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue is related to a user mode write AV in the DllGetClassObject function.
- CVE-2017-14691High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file.
- CVE-2017-14690High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to faulting address controls affecting subsequent write addresses.
- CVE-2017-14689High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file. The issue relates to the use of data from a faulting address as arguments in subsequent function calls.
- CVE-2017-14688High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, related to a 'Read Access Violation'.
- CVE-2017-14579High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a 'Read Access Violation on Control Flow'.
- CVE-2017-14577High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue is related to a Read Access Violation on Control Flow.
- CVE-2017-14576High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, potentially leading to stack corruption.
- CVE-2017-14575High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue is related to an 'Illegal Instruction' violation concerning an unknown symbol.
- CVE-2017-14574High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a 'User Mode Write AV'.
Original NVD description (English source)
STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, related to "Data from Faulting Address controls Branch Selection starting at STDUEPubFile!DllUnregisterServer+0x0000000000010332."