IrfanView TIFF Image Decompression Buffer Overflow Vulnerability

Last Update Date: 14 Nov 2012 Release Date: 12 Nov 2012 4250 Views

RISK: High Risk

TYPE: Clients - Graphics & Design

A vulnerability has been identified in IrfanView, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error when processing JPEG compressed TIFF images and can be exploited to cause a heap-based buffer overflow via a specially crafted "ImageWidth" value.

Successful exploitation may allow execution of arbitrary code, but requires tricking a user into opening a malicious file.

Impact

Remote Code Execution

System / Technologies affected

IrfanView 4.x

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

Update to version 4.35.

Vulnerability Identifier

CVE-2009-5022

Source

Secunia