vendor:
DjVuLibre
by:
dean
3.3
CVSS
LOW
Buffer Overflow
119
CWE
Product Name: DjVuLibre
Affected Version From: 3
Affected Version To: 3
Patch Exists: NO
Related CWE: CVE-2008-4922
CPE: a:djvulibre_project:djvulibre
Platforms Tested: Windows
2010
DjVu DjVu_ActiveX_MSOffice.dll ActiveX Component Buffer Overflow
This module exploits a stack buffer overflow in DjVu ActiveX Component. When sending an overly long string to the ImageURL() property of DjVu_ActiveX_MSOffice.dll (3.0) an attacker may be able to execute arbitrary code. This control is not marked safe for scripting, so choose your attack vector accordingly.
Mitigation:
Apply the latest patches and updates for DjVu ActiveX Component. Avoid opening untrusted DjVu files.
