Vulnerability Spotlight: Multiple vulnerabilities in Computerinsel Photoline
Summary: Cisco Talos disclosed multiple vulnerabilities in Computerinsel GmbH's PhotoLine image editor, tracked as TALOS-2017-0387 (CVE-2017-2880), TALOS-2017-0427 (CVE-2017-2920), TALOS-2017-0458 (CVE-2017-12106) and TALOS-2017-0459 (CVE-2017-12107), which may allow an attacker to execute arbitrary code remotely when a specially crafted image file is opened. The flaws include a GIF parsing issue where a short byte value is read and used in a memory loop containing memory write instructions, plus memory corruption in the TGA and .PCX parsing functionality that a crafted file can trigger.
Bottom line: The trigger is simply opening a file in one of the most common image formats on the internet, so an attacker needs no other foothold than getting a crafted image in front of a PhotoLine user. Talos also recommends users of other popular image editing programs install the latest updates, which means the exposure is not confined to this one product.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-12106CVE-2017-12107CVE-2017-2880CVE-2017-2920
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026