The H-Online: Version 1.98.8 of the popular XnView image viewer and converter has been released to close security holes in the software. According to an advisory from security service provider Secunia, the update addresses three “highly critical” vulnerabilities that could be exploited by an attacker to execute arbitrary code and compromise a victim’s system.
These include a stack-based buffer overflow caused by a boundary error when parsing a directory name while browsing folders such as those from an extracted archive file, and, a heap-based buffer overflow when processing image content using the FlashPix plugin (Xfpx.dll). A second heap-based buffer overflow caused when processing image data in Personal Computer eXchange (PCX) files has also been fixed. For an attack to be successful, a user must first open a specially crafted file.
The problems are confirmed to affect XnView 1.98.5, however, other versions may also be vulnerable. Upgrading to 1.98.8 – available to download for 32-bit versions of Windows – corrects the problems.