« Volver al listado

CVE-2013-3944

Estado: ModificadaAlta (7.8)—

Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via an IMAGE tag.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Extensis — Mrsid

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-3944",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT-CNA@flexerasoftware.com",
      "affectedData": [
        {
          "vendor": "IrfanView",
          "product": "MrSID plugin",
          "versions": [
            {
              "status": "affected",
              "version": "before 4.37"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-02T19:15:11.697",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/64385",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89804",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "https://www.irfanview.com/history_old.htm",
      "tags": [
        "Release Notes"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/64385",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89804",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.irfanview.com/history_old.htm",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via an IMAGE tag."
    },
    {
      "lang": "es",
      "value": "Un desbordamiento de búfer en la región stack de la memoria en el plugin MrSID (MrSID.dll) versiones anteriores a  la versión 4.37 para IrfanView, permite a atacantes remotos ejecutar código arbitrario por medio de una etiqueta IMAGE."
    }
  ],
  "lastModified": "2026-06-16T23:56:03.890",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:extensis:mrsid:*:*:*:*:*:irfanview:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3CC0587-3E2B-46FD-8B96-6D698B261528",
              "versionEndExcluding": "4.37"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"
}