Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
741 results · page 4 of 15
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11544 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24707.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11543 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24704.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11542 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24703.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11541 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24702.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-11540 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24700.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11539 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24699.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11538 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24629.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-11537 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24620.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-11536 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24619.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-11535 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24618.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-11534 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24617.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-11533 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24616.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-11532 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24615.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-11531 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24606.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView CGM File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11530 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24605.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-11529 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24604.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11528 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24602.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11527 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24601.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-11526 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24600.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-11525 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24599.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11524 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24598.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11523 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24597.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11522 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24595.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DJVU File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-11521 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DJVU File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DJVU files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24578.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView ARW File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-11520 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView ARW File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ARW files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24488.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView RLE File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-11519 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView RLE File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RLE files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24445.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView RLE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-11518 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView RLE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RLE files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24444.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView JPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-11517 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView JPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24118.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView JPM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-11516 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView JPM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24011.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView JPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-11515 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView JPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24010.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView ECW File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-11514 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView ECW File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ECW files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23975.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView ECW File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-11513 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView ECW File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ECW files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23971.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView WBZ Plugin WB1 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-11512 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView WBZ Plugin WB1 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WB1 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22741.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView XCF Plugin XCF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-11511 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView XCF Plugin XCF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XCF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22735.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView WBZ plugin WB1 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-11510 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView WBZ plugin WB1 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WB1 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22718.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-11509 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SVG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22185.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Type Confusion Remote Code Execution Vulnerability.CVE-2024-11508 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22184.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DXF File Parsing Type Confusion Remote Code Execution Vulnerability.CVE-2024-11507 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DXF File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22177.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-11506 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22169.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView PSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-6817 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView PSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23216.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-6816 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23214.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView RLE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-6815 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView RLE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RLE files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23159.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView PIC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-5877 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView PIC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PIC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23974.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-5876 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23973.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView SHP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-5875 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView SHP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SHP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23972.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024IrfanView PNT File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-5874 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView PNT File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNT files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23969.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024Buffer Overflow vulnerability in IrfanView 32bit v.4.66 allows a local attacker to cause a denial of service via a crafted file.CVE-2024-31007 · Other software · irfanview · reported by MITREMedium 5.5
Buffer Overflow vulnerability in IrfanView 32bit v.4.66 allows a local attacker to cause a denial of service via a crafted file. Affected component is IrfanView 32bit 4.66 with plugin formats.dll.
- Product
- irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commediaside.net
Aug 28, 2024An issue in the component EXR!ReadEXR+0x4eef0 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file.CVE-2024-44915 · Other software · irfanview · reported by MITREMedium 5.5
An issue in the component EXR!ReadEXR+0x4eef0 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service (DoS).
- Product
- irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024An issue in the component EXR!ReadEXR+0x3df50 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file.CVE-2024-44914 · Other software · irfanview · reported by MITREMedium 5.5
An issue in the component EXR!ReadEXR+0x3df50 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service (DoS).
- Product
- irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file.CVE-2024-44913 · Other software · irfanview · reported by MITREMedium 5.5
An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service (DoS).
- Product
- irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.