CVE-2017-15763
HighSummary
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue relates to faulting address control affecting subsequent write addresses.
Risk Assessment
This vulnerability could lead to serious consequences, including system takeover or disruption of service. Organizations should be aware of the risks associated with opening unknown .dwg files.
Recommendation
It is recommended to update IrfanView and the BabaCAD4Image plugin to the latest versions to minimize risk. Additionally, limit the opening of .dwg files from unknown sources.
Other vulnerabilities in IrfanView 4.50 - 64bit, BabaCAD4Image plugin version 1.3
See all- CVE-2017-15764High
IrfanView version 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file.
- CVE-2017-15762High
IrfanView version 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file.
- CVE-2017-15761High
IrfanView version 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file.
- CVE-2017-15760High
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file.
- CVE-2017-15759High
IrfanView version 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file.
- CVE-2017-15758High
IrfanView version 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file.
- CVE-2017-15757High
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file.
- CVE-2017-15756High
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file.
- CVE-2017-15754High
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file.
- CVE-2017-15753High
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file.
Original NVD description (English source)
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at BabaCAD4Image!ShowPlugInOptions+0x000000000001eca0."