Detections
Analytics
FastStone Image Viewer <= 7.8 Multiple Vulnerabilities
high Nessus Plugin ID 208256
Language:
Synopsis
An image viewing application installed on the remote Windows host is affected by multiple vulnerabilities.Description
The version of FastStone Image Viewer installed on the remote Windows host is prior to or equal to 7.8. It is, therefore, affected by multiple vulnerabilities:- A specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. (CVE-2024-9112)
- A specific flaw exists within the parsing of TGA files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. (CVE-2024-9113)
- A specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. (CVE-2024-9114)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
See linked advisories for more details.See Also
https://www.zerodayinitiative.com/advisories/ZDI-24-1273/
Plugin Details
Severity: High
ID: 208256
File Name: faststone_image_viewer_7_8.nasl
Version: 1.2
Type: local
Agent: windows
Family: Windows
Published: 10/8/2024
Updated: 10/9/2024
Supported Sensors: Nessus Agent, Nessus
Risk Information
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.3
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-9112
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:faststone:image_viewer
Required KB Items: SMB/Registry/Enumerated, installed_sw/FastStone Image Viewer
Exploit Ease: No known exploits are available
Patch Publication Date: 9/23/2024
Vulnerability Publication Date: 9/23/2024