CVE-2017-14575
HighSummary
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue is related to an 'Illegal Instruction' violation concerning an unknown symbol.
Risk Assessment
Exploitation of this vulnerability could lead to serious consequences, such as system takeover or disruption of service. Organizations should be aware of the risks associated with opening unknown .xps files.
Recommendation
It is recommended to update STDU Viewer to the latest version and to avoid opening .xps files from untrusted sources.
Other vulnerabilities in STDU Viewer 1.6.375
See all- CVE-2017-14692High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue is related to a user mode write AV in the DllGetClassObject function.
- CVE-2017-14691High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file.
- CVE-2017-14690High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to faulting address controls affecting subsequent write addresses.
- CVE-2017-14689High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file. The issue relates to the use of data from a faulting address as arguments in subsequent function calls.
- CVE-2017-14688High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, related to a 'Read Access Violation'.
- CVE-2017-14579High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a 'Read Access Violation on Control Flow'.
- CVE-2017-14577High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue is related to a Read Access Violation on Control Flow.
- CVE-2017-14576High
STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, potentially leading to stack corruption.
- CVE-2017-14574High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a 'User Mode Write AV'.
- CVE-2017-14573High
STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue relates to an 'Illegal Instruction Violation'.
Original NVD description (English source)
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal Instruction Violation starting at Unknown Symbol @ 0x0000000002d8024c called from STDUXPSFile!DllUnregisterServer+0x000000000002566c."