A vulnerability classified as critical was found in AccuSoft ImageGear 19.4. Affected by this vulnerability is the function fillinraster in the library igcore19d.dll. The manipulation as part of a TIFF File leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An exploitable code execution vulnerability exists in the TIFF fillinraster function of the igcore19d.dll library of Accusoft ImageGear 19.4, 19.5 and 19.6. A specially crafted TIFF file can cause an out-of-bounds write, resulting in remote code execution. An attacker can provide a malicious file to trigger this vulnerability.

The weakness was disclosed 05/06/2020. This vulnerability is known as CVE-2020-6094 since 01/07/2020. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/07/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries 154836, 154835 and 154834 are pretty similar.

Productinfo

Vendor

• AccuSoft

Name

• ImageGear

Version

• 19.4

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion