CVE-2017-14580

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

XnView Classic for Windows Version 2.41 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode Write AV starting at jbig2dec+0x000000000000870f."

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-145817.5The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) v CVE-2017-145825.9The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allo CVE-2017-145836.5NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a De CVE-2017-145857.2A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was intr CVE-2017-145869.8The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop c CVE-2017-145875.4The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary CVE-2017-145886.1Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a CVE-2017-145899.6It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted a CVE-2017-14594.2IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resou CVE-2017-145909.1Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to cr CVE-2017-145919.0Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercuria CVE-2017-145928.8Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission t