Buffer overflow in Jpchacha Chasys_draw_ies
CVE-2013-3928
Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote attackers to execute arbitrary code via crafted biPlanes and biBitCount fields in a BMP file.
Vulnerability class: Buffer Overflow
EPSS: 0.761 (98.9th percentile) — read the EPSS interpretation.
Affected products
- Jpchacha Chasys_draw_ies — versions 4.00.01, 4.01.01, 4.02.01
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- chasysdrawies-cve20133928-fltbmp-bo(86035) (vdb-entry, x_refsource_XF)
- PSIRT-CNA@flexerasoftware.com (x_refsource_MISC)
- PSIRT-CNA@flexerasoftware.com (x_refsource_CONFIRM)
- PSIRT-CNA@flexerasoftware.com (Exploit, x_refsource_MISC)
- 61463 (vdb-entry, x_refsource_BID)
- 53773 (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- 27609 (Exploit, exploit, x_refsource_EXPLOIT-DB)
- PSIRT-CNA@flexerasoftware.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2013-3928?
- CVE-2013-3928 is a vulnerability in Jpchacha Chasys_draw_ies, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-03-11.
- Is CVE-2013-3928 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.