Fixed Cve-2023-24304

[nascent]

hi, any news on a fix for CVE-2023-24304 ?

[JendaLinda]

The bug was found in version 4.60. The current IrfanView version is 4.62.

[nascent]

many thanks, didn't see any explicit mention of it in the changelogs so wasn't certain

[stipe.soldo]

Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x0000000000001bf0.

Any news on a new Update?
CVE-2023-26974

[Bhikkhu Pesala]

Have you reported the bug to Irfan Skiljan?

Apparently, it was already fixed.

[stipe.soldo]

I informed Irfan about the issue through email.

[AllonZ]

FYI: IrfanView 4.62 is currently being detected as a vulnerability in Acronis:

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26974
cve.org/CVERecord?id=CVE-2023-26974

Reference: github.com/overXsky/IrfanviewPoc

[JendaLinda]

Individual plugins are being updated between IrfanView releases.
Please check PlugIns updated after the version 4.62 section on the Plugins download page.

?

[Bhikkhu Pesala]

Updated after version 4.62

• JP2 (JPEG2000) PlugIn (4.62) - ZIP (32 bit) or ZIP (64 bit) - Loading errors fixed, thanks to overXsky (CVE-2023-26974)

?

[stipe.soldo]

Updated after version 4.62

• JP2 (JPEG2000) PlugIn (4.62) - ZIP (32 bit) or ZIP (64 bit) - Loading errors fixed, thanks to overXsky (CVE-2023-26974)

?

According to Irfan, you should copy the new JPEG2000.dll file into your plugin folder.
However, please note that it will not be recognized by Windows Defender portal or Acronis until you have upgraded to IrfanView version 4.63 or higher.
?

[JendaLinda]

Yes, replace the DLL file with the fixed version. Then you can ignore security warnings regarding this bug.
I'm marking this as fixed.