Detections
Analytics
Google Picasa < 3.9 Build 3.9.14.34 Multiple Vulnerabilities (Mac OS X)
medium Nessus Plugin ID 65926
Language:
Synopsis
The remote Mac OS X host contains a photo organization application that is affected by multiple vulnerabilities.Description
The installed version of Google Picasa is earlier than 3.9 Build 3.9.14.34. As such, it is affected by the following vulnerabilities:- A buffer underflow vulnerability exists in the 'LZWDecodeCompat' function in the LibTIFF library. An attacker could exploit this issue through the use of a specially crafted TIFF image, potentially causing a denial of service. (CVE-2009-2285)
- A sign-extension flaw exists that is triggered by the 'biBitCount' field that is not properly validated when processing the BMP color table. An attacker could exploit this issue though a specially crafted BMP image, potentially causing a heap-based buffer overflow resulting in a denial of service or arbitrary code execution.
Solution
Upgrade to Google Picasa 3.9 Build 3.9.14.34 or later.See Also
Plugin Details
Severity: Medium
ID: 65926
File Name: macosx_picasa_3_9_14_34.nasl
Version: 1.3
Type: local
Agent: macosx
Family: MacOS X Local Security Checks
Published: 4/11/2013
Updated: 11/27/2019
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.5
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.4
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2009-2285
Vulnerability Information
CPE: cpe:/a:google:picasa
Required KB Items: MacOSX/Picasa/Installed
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/14/2013
Vulnerability Publication Date: 3/14/2013
Reference Information
CVE: CVE-2009-2285
CWE: 119