CVE-1999-1112

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Buffer overflow in IrfanView32 3.07 and earlier allows attackers to execute arbitrary commands via a long string after the "8BPS" image type in a Photo Shop image header.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://stud4.tuwien.ac.at/~e9227474/main2.htmlVendor Advisory
http://www.securityfocus.com/archive/1/34066Exploit, Vendor Advisory
http://www.securityfocus.com/bid/781Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/3549
http://stud4.tuwien.ac.at/~e9227474/main2.htmlVendor Advisory
http://www.securityfocus.com/archive/1/34066Exploit, Vendor Advisory
http://www.securityfocus.com/bid/781Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/3549

Timeline

Published: Nov 9, 1999
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 1999

CVE-1999-11172.1lquerypv in AIX 4.1 and 4.2 allows local users to read arbitrary files by specifying the file in the -h command line parameter.CVE-1999-11247.5HTTP Client application in ColdFusion allows remote attackers to bypass access restrictions for web pages on other ports by providing the ta CVE-1999-11262.1Cisco Resource Manager (CRM) 1.1 and earlier creates certain files with insecure permissions that allow local users to obtain sensitive conf CVE-1999-11277.5Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote attackers to cause a denial of service (r CVE-1999-11297.5Cisco Catalyst 2900 Virtual LAN (VLAN) switches allow remote attackers to inject 802.1q frames into another VLAN by forging the VLAN identif CVE-1999-11305.0Default configuration of the search engine in Netscape Enterprise Server 3.5.1, and possibly other versions, allows remote attackers to read CVE-1999-11325.0Windows NT 4.0 allows remote attackers to cause a denial of service (crash) via extra source routing data such as (1) a Routing Information CVE-1999-11485.0FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via many passive (PASV) connec CVE-1999-11565.0BisonWare FTP Server 4.1 and earlier allows remote attackers to cause a denial of service via a malformed PORT command that contains a non-n CVE-1999-11575.0Tcpip.sys in Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service via an ICMP Subnet Mask Address Request packet, CVE-1999-11637.5Vulnerability in HP Series 800 S/X/V Class servers allows remote attackers to gain access to the S/X/V Class console via the Service Support CVE-1999-11645.0Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL header