CVE-2008-5870 Denial of service in n/a
An attacker can crash FastStone Image Viewer by tricking a user into opening a malformed BMP image with large dimensions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2008-5870?
CVE-2008-5870 is a medium-severity denial of service vulnerability in n/a, published on 8 Jan 2009. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
FastStone Image Viewer 3.6 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with large width and height values, possibly a related issue to CVE-2007-1942.
Weakness: CWE-20
Which versions are affected by CVE-2008-5870?
It affects 1 product.
Products include Faststone Image Viewer.
How do I fix CVE-2008-5870?
No fix has been published for CVE-2008-5870 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2008-5870 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-5870 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2022-36947 Memory corruption in n/a
- CVE-2007-1942 Integer overflow in n/a
- CVE-2024-9112 FastStone Image Viewer PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-9113 FastStone Image Viewer TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-9114 FastStone Image Viewer GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Sources
Also known as GHSA-h2vw-w82v-gjxx.