Secunia

Will Dormann has reported some vulnerabilities in ER Mapper ECW JPEG 2000 Plug-ins, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors within the NCSViewManager.NCSView.1 (NCSView.dll) ActiveX control when processing certain unspecified methods or properties. These can be exploited to cause stack-based buffer overflows when a user e.g. visits a malicious website.

Successful exploitation allows execution of arbitrary code.

Solution
Update to NCSView.dll version 3.4.0.242 included in version 8.1 of ER Mapper ECW JPEG 2000 Plug-ins.

Provided and/or discovered by
Will Dormann, CERT/CC

Original Advisory
US-CERT VU#589188:
http://www.kb.cert.org/vuls/id/589188

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area