Heap-based buffer overflow in IrfanView - CVE-2012-5904

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Heap-based buffer overflow in IrfanView before 4.33. A remote attacker can use a crafted RLE compressed bitmap file such as a DIB to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

How to mitigate CVE-2012-5904

Sources

• http://osvdb.org/80716
• http://secunia.com/advisories/47333
• http://www.irfanview.com/history_old.htm
• http://www.securityfocus.com/bid/52806
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74452