CVE-2013-3247

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

Heap-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted RLE compressed layer in an XCF file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
XnView	XnView	before 2.03

References

http://www.fuzzmyapp.com/advisories/FMA-2013-003/FMA-2013-003-EN.xmlExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84642Third Party Advisory, VDB Entry
http://www.fuzzmyapp.com/advisories/FMA-2013-003/FMA-2013-003-EN.xmlExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84642Third Party Advisory, VDB Entry

Timeline

Published: Jan 2, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-32489.3Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in t CVE-2013-32499.3Stack-based buffer overflow in the "Add from text file" feature in the DameWare Exporter tool (DWExporter.exe) in DameWare Remote Support 10 CVE-2013-32506.8Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hija CVE-2013-32516.8Cross-site request forgery (CSRF) vulnerability in the qTranslate plugin 2.5.34 and earlier for WordPress allows remote attackers to hijack CVE-2013-32526.8Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote CVE-2013-32536.8Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows rem CVE-2013-32544.3Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote at CVE-2013-32566.8Cross-site request forgery (CSRF) vulnerability in the Shareaholic SexyBookmarks plugin 6.1.4.0 for WordPress allows remote attackers to hij CVE-2013-32576.8Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the CVE-2013-32586.8Cross-site request forgery (CSRF) vulnerability in he Digg Digg plugin before 5.3.5 for WordPress allows remote attackers to hijack the auth CVE-2013-32596.8Stack-based buffer overflow in INMATRIX Zoom Player before 8.7 beta 11 allows remote attackers to execute arbitrary code via a large biClrUs CVE-2013-32606.8Heap-based buffer overflow in INMATRIX Zoom Player before 8.7 beta 11 allows remote attackers to execute arbitrary code via a large biClrUse