CVE-2012-3585

critical

Published 2012-07-05 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

10.0

Description

Heap-based buffer overflow in jpeg_ls.dll in the Jpeg_LS (aka JLS) plugin in the formats plugins in IrfanView PlugIns before 4.34 allows remote attackers to execute arbitrary code via a crafted JLS file.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-19483 dos windows text · 3 KB

Joseph Sheridan · 2012-06-30

IrfanView JLS Formats PlugIn - Heap Overflow

text exploit Source: Exploit-DB

Summary
=======

IrfanView Formats PlugIn is prone to an overflow condition. The JLS Plugin 
(jpeg_ls.dll) library fails to properly sanitize user-supplied input 
resulting in a heap-based buffer overflow. With a specially crafted JLS 
compressed image file, a context-dependent attacker could potentially 
execute arbitrary code.

CVE number: CVE-2012-3585
Impact: high
Vendor Homepage: http://www.ifranview.com/
Vendor Notified: 16/06/2012
Found by: Joseph Sheridan of Reaction Information Security
href="http://www.reactionpenetrationtesting.co.uk/joseph-sheridan.html

This advisory is posted at:
http://www.reactionpenetrationtesting.co.uk/Irfanview-JLS-Heap-Overflow.
html

POC file posted at:
http://www.reactionpenetrationtesting.co.uk/vuln.jls
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21741.jls


Affected Products
=================

Irfanview Plugins version 4.33

Details
=======

IrfanView Formats PlugIn is prone to an overflow condition. The JLS Plugin 
(jpeg_ls.dll) library fails to properly sanitize user-supplied input 
resulting in a heap-based buffer overflow. With a specially crafted JLS 
compressed image file, a context-dependent attacker could potentially 
execute arbitrary code.

Impact
======

If a user could be enticed to open a malicious JLS file, the attack could 
result in remote code execution.

Solution
===========
Upgrade to Irfanview Plugins version 4.34

The following jls dll has been patched:
http://www.irfanview.net/plugins/jpeg_ls.zip

Distribution
============

In addition to posting on the website, a text version of this notice
is posted to the following e-mail and Usenet news recipients.

* bugtraq () securityfocus com
* full-disclosure () lists grok org uk
* oss [dash] security [dash] subscribe [at] lists [dot] openwall [dot] com or

Future updates of this advisory, if any, will be placed on the ReactionIS
corporate website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the URL below for any updates:

http://www.reactionpenetrationtesting.co.uk/Irfanview-JLS-Heap-Overflow.
html

========================================================================
======

Reaction Information Security 
Lombard House Business Centre,
Suite 117,
12-17 Upper Bridge Street,
Canterbury, Kent, CT1 2NF

Phone: +44 (0)1227 785050
Email: research () reactionis {dot} co {dot} uk
Web: http://www.reactionpenetrationtesting.co.uk

Joseph Sheridan
Technical Director
Principal Consultant
CHECK Team Leader, CREST Infrastructure, CREST Application, CISSP
Tel: 07812052515
Web: www.reactionis.com
Email: joe (at) reactionis.co (dot) uk [email concealed]

Reaction Information Security Limited.
Registered in England No: 6929383
Registered Office: 1, The Mews, 69 New Dover Road, Canterbury, CT1 3DZ

This email and any files transmitted with it are confidential and are intended solely for the use of the individual to whom they are addressed. If you are not the intended recipient please notify the sender. Any unauthorised dissemination or copying of this email or its attachments and any use or disclosure of any information contained in them, is strictly prohibited.

ï Please consider the environment before printing this email

Application impact

Vendor	Product	Versions	Fixed
irfanview	irfanview_plugins	`{"endIncluding":"4.33"}`
irfanview	irfanview

References

CWEs

CWE-119

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.