CVE-2017-2155

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
ICON CORPORATIONHoozin ViewerVer2
ICON CORPORATIONHoozin ViewerVer3
ICON CORPORATIONHoozin ViewerVer4.1.5.15 and earlier
ICON CORPORATIONHoozin ViewerVer5.1.2.13 and earlier
ICON CORPORATIONHoozin ViewerVer6.0.3.09 and earlier

References

Timeline

Published
Apr 28, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-21567.8Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary codCVE-2017-21577.3Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for WindowCVE-2017-21583.3Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended contents to be extracted froCVE-2017-21613.5FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier and FlashAirTM SDHC Memory Card (SD-WD/WC Series <W-02>) V2.00.04 andCVE-2017-21624.3FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier and FlashAirTM SDHC Memory Card (SD-WD/WC Series <W-02>) V2.00.04 andCVE-2017-21637.5Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop_id.CVE-2017-21646.1Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbitrary web script or HTCVE-2017-21656.5GroupSession versions 4.6.4 and earlier allows remote authenticated attackers to bypass access restrictions to obtain sensitive information CVE-2017-21666.1Open redirect vulnerability in GroupSession version 4.7.0 and earlier allows an attacker to redirect users to arbitrary web sites and conducCVE-2017-21677.8Untrusted search path vulnerability in Installer for PrimeDrive Desktop Application version 1.4.4 and earlier allows remote attackers to exeCVE-2017-21686.1Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to verCVE-2017-21696.1Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to i
CVE-2017-2155: High severity, CVSS 8.8 | Vulnix