SB2017102208 - Multiple vulnerabilities in IrfanView

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2017-15768)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

IrfanView version 4.50 - 64bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file, related to "Data from Faulting Address controls Branch Selection starting at image000007f7_42060000+0x0000000000094113."

2) Buffer overflow (CVE-ID: CVE-2017-15769)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

IrfanView 4.50 - 64bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dds file, related to "Read Access Violation starting at FORMATS!ReadBLP_W+0x0000000000001b22."

Remediation

Install update from vendor's website.

References

• https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15768
• https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-15769