Skip to content

Visual truncation vulnerability in WinImage 8.10 and...

High severity Unreviewed Published May 1, 2022 to the GitHub Advisory Database • Updated Jan 31, 2023

Package

No package listedSuggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Visual truncation vulnerability in WinImage 8.10 and earlier allows remote attackers to spoof a destination filename via a long sequence of space characters in a filename within a (1) .IMG or (2) .ISO file. NOTE: this can be leveraged with a separate directory traversal vulnerability to trick a careful user into overwriting arbitrary files.

References

Published by the National Vulnerability Database Sep 18, 2007
Published to the GitHub Advisory Database May 1, 2022
Last updated Jan 31, 2023

Severity

High

Weaknesses

No CWEs

CVE ID

CVE-2007-4963

GHSA ID

GHSA-7fm8-q3qr-gfwv

Source code

No known source code

Dependabot alerts are not supported on this advisory because it does not have a package from a supported ecosystem with an affected and fixed version.

Learn more about GitHub language support

Checking history
See something to contribute? Suggest improvements for this vulnerability.