CVE-2017-8781
HighSummary
XnView Classic version 2.40 for Windows allows user-assisted remote attackers to execute code via a crafted JPEG 2000 file that is mishandled during the opening of a directory in 'Browser' mode, due to a 'Stack Buffer Overrun' issue.
Risk Assessment
Attackers may remotely execute malicious code, posing a serious threat to system and user data security. Organizations should be aware of the risks associated with using this version of the software.
Recommendation
It is recommended to update XnView Classic to the latest version to mitigate this vulnerability. Additionally, avoid opening unknown JPEG 2000 files.
Other vulnerabilities in XnView Classic 2.40
See all- CVE-2017-15789High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a User Mode Write AV concerning CADImage.
- CVE-2017-15788High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a User Mode Write AV concerning CADImage.
- CVE-2017-15787High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a Data Execution Prevention Violation.
- CVE-2017-15786High
XnView Classic version 2.43 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a 'Read Access Violation'.
- CVE-2017-15785High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a Data Execution Prevention Violation near NULL.
- CVE-2017-15784High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to an 'Illegal Instruction Violation'.
- CVE-2017-15783High
XnView Classic version 2.43 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file.
- CVE-2017-15782High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a User Mode Write AV concerning CADImage.
- CVE-2017-15781High
XnView Classic version 2.43 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file. The issue is related to a Read Access Violation on Control Flow.
- CVE-2017-15780High
XnView Classic version 2.43 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a 'Read Access Violation starting at CADImage+0x0000000000285dad.'
Original NVD description (English source)
XnView Classic for Windows Version 2.40 allows user-assisted remote attackers to execute code via a crafted JPEG 2000 file that is mishandled during the opening of a directory in "Browser" mode, because of a "Stack Buffer Overrun" issue.