Two vulnerabilities have been reported in IrfanView Formats PlugIn, which can be exploited by malicious people to compromise a user's system.

1) An error within DjVu.dll when decompressing DjVu images can be exploited to cause a heap-based buffer overflow via a specially crafted file.

This vulnerability is confirmed in version 4.33. Other versions may also be affected.

2) An error within Jpeg_LS.dll when decompressing JLS images can be exploited to cause a heap-based buffer overflow via a specially crafted file.

This vulnerability is reported in version 4.33. Other versions may also be affected.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires tricking a user into opening a malicious file.

Solution
Apply patches .
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Francis Provencher via Secunia
2) Joseph Sheridan, Reaction Information Security

Changelog
Further details available to Secunia VIM customers

Original Advisory
IrfanView:
http://www.irfanview.com/plugins.htm

Francis Provencher:
http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=56&Itemid=56

Reaction Information Security:
http://www.reactionpenetrationtesting.co.uk/Irfanview-JLS-Heap-Overflow.html

Deep Links
Links available to Secunia VIM customers