critical9.3Public exploit code
CVE-2012-4988
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- XnView 1.99.1 - '.JLS' File Decompression Heap Overflow2012-10-04 · dos · windows
Impact
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xnview | Xnview | Versions 1.99, 1.99.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/show/osvdb/85893
- http://seclists.org/fulldisclosure/2012/Oct/36
- http://secunia.com/advisories/50825
- http://www.reactionpenetrationtesting.co.uk/xnview-jls-heap.html
- http://www.securityfocus.com/bid/55787
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79030
- https://www.exploit-db.com/exploits/21741/
- http://osvdb.org/show/osvdb/85893
- http://seclists.org/fulldisclosure/2012/Oct/36
- http://secunia.com/advisories/50825
- http://www.reactionpenetrationtesting.co.uk/xnview-jls-heap.html
- http://www.securityfocus.com/bid/55787
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79030
- https://www.exploit-db.com/exploits/21741/