Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2018-3860: Canvas Draw 4.0.0 may run code from crafted TIFF image
CVE-2018-3860 · published 8 years ago
Summary
The Canvas Draw 4.0.0 program can be tricked by a specially made TIFF picture to overwrite its own data and start unwanted code. This could let an attacker take control of the system when the image is opened. Apply the vendor's update or avoid opening TIFF files from unknown sources until a fix is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| acdsystems | canvas_draw |
4.0.0 cpe:2.3:a:acdsystems:canvas_draw:4.0.0:*:*:*:*:*:*:* |
Original advisory text
An exploitable out-of-bounds write exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds w...
An exploitable out-of-bounds write exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain the ability to execute code. A different vulnerability than CVE-2018-3859.
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0544 Exploit Technical Description Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published19 Jul 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-3860 · NVD
Track software like this
Free during beta