ACDSee Pro < 5.2 Multiple Memory Corruption Vulnerabilities

high Nessus Plugin ID 59785

Language:

Synopsis

The remote Windows host has an image editing application installed that is affected by multiple code execution vulnerabilities.

Description

ACDSee, an image editing application, is installed on the remote host. The installed version of ACDSee is earlier than 5.2 and thus is potentially affected by multiple vulnerabilities :

- Insufficient validation in ID_ICO.apl when copying colors from cursors in .CUR files can be exploited to cause a heap-based buffer overflow.

- An error in IDE_ACDStd.apl when allocating memory based on values in the Logical Screen Descriptor of a GIF image can be exploited to corrupt heap memory.

- Insufficient validation of ID_PICT.apl of specific byte values used as sizes in the image content can be exploited to cause a heap-based buffer overflow.

- Insufficient validation in IDE_ACDStd.apl of specific byte values used as sizes in the image content when decompressing run-length encoded bitmaps can be exploited to cause a heap-based buffer overflow.

Solution

Upgrade to ACDSee version 5.2 or later.

Plugin Details

Severity: High

ID: 59785

File Name: acdseepro_52_multiple_vulns.nasl

Version: 1.5

Type: local

Agent: windows

Family: Windows

Published: 6/29/2012

Updated: 8/8/2018

Supported Sensors: Nessus Agent, Nessus

Vulnerability Information

CPE: cpe:/a:acdsystems:acdsee

Required KB Items: SMB/Registry/Enumerated

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/21/2012

Vulnerability Publication Date: 6/21/2012

Reference Information

BID: 54138

Detections

Analytics