In association with heise online

16 April 2012, 14:56

Critical vulnerability in IrfanView plugin

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

IrfanView image The official plugin package for the popular image viewer IrfanView is currently shipped with a vulnerable version of the FlashPix plugin. The code contains a critical vulnerability which could be exploited an attacker to infect a system with malicious code; the hole is caused by a heap buffer overflow.

An attacker merely needs to get a user to open a specially crafted FlashPix format image with IrfanView to get their code to run. Admittedly, this is a relatively exotic file format which might not be opened deliberately, but it opening the file could also occur unknowingly, for example, when looking at a folder full of images and browsing their thumbnails with IrfanView.

The FlashPix hole is patched in version 4.34 of the plugin pack but it must be reinstalled manually. The gap was discovered by security researcher Francis Provencher who reported it, confidentially, to Secunia. He has since releasedDirect download a proof of concept, which means that IrfanViw users who have installed the plugin package should update as soon as possible. A month ago, a similar issue in the XnView image viewer was also fixed.


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit