Stack-based buffer overflow in IrfanView - CVE-2012-0897

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2012-0897

Links to Public Exploits and PoC-codes

• Exploit #4390 - IrfanView JPEG2000 4.3.2.0 - jp2 Stack Buffer Overflow (Metasploit) (August 11, 2020)

External References

• http://osvdb.org/78333
• http://secunia.com/advisories/47360
• http://www.irfanview.com/history_old.htm
• http://www.securityfocus.com/bid/51426
• http://www.securitytracker.com/id/1032529
• http://www.securitytracker.com/id/1032530
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72398

Related Security Bulletins

• Multiple vulnerabilities in IrfanView
• Multiple vulnerabilities in VMware Workstation and Fusion
• Multiple vulnerabilities in VMware Horizon Client