Picasa

Vendor:

First CVE: Sep 11, 2007 · Active for 18 years

11

Total CVEs

More Total CVEs than 89% of tracked products

2.8

Avg CVEs / Year

Higher CVE frequency than 75% of tracked products

7.8

Avg CVSS

Higher Avg CVSS than 63% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Picasa over time

Volume of CVEsAvg CVSS Base Score

First CVE

Sep 11, 2007

18 years ago

Most Recent CVE

Nov 17, 2015

3,902 days ago

CVE Severity & Scoring

Picasa11 CVEs

27%

73%

All CVEs352,294 CVEs

45%

40%

11%

MediumHigh

Attack Vector

Local0 (0.0%)

Network0 (0.0%)

Unknown11 (100.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low0 (0.0%)

High0 (0.0%)

Unknown11 (100.0%)

User Interaction

None0 (0.0%)

Unknown11 (100.0%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None0 (0.0%)

Unknown11 (100.0%)

Top CVEs

Signals from CVEs in this product scope (11 CVEs).

11 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2011-2747HIGH Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images, which allows remote attackers to execute arbitrary code via a crafted image file.	Jul 28, 2011	9.3	29	NO	NO
CVE-2015-8221HIGH Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb image, which triggers a heap-based buffe	Nov 17, 2015	10.0	26	NO	NO
CVE-2015-8096HIGH Integer overflow in Google Picasa 3.9.140 Build 239 and Build 248 allows remote attackers to execute arbitrary code via unspecified vectors related to "phase one 0x412 tag," which	Nov 9, 2015	10.0	26	NO	NO
CVE-2011-0458MEDIUM Untrusted search path vulnerability in the Locate on Disk feature in Google Picasa before 3.8 allows local users to gain privileges via a Trojan horse executable file in the curren	Mar 28, 2011	6.9	22	NO	NO
CVE-2013-5359HIGH Stack-based buffer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 might allow remote attackers to execute arbitrary code via a crafted RAW file, as demonstrated	Jan 9, 2014	7.5	20	NO	NO
CVE-2013-5357HIGH Integer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a long TIFF tag that triggers a heap-based buffer o	Jan 9, 2014	7.5	20	NO	NO
CVE-2013-5349HIGH Integer underflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a crafted JPEG tag that triggers a heap-based buff	Jan 9, 2014	7.5	20	NO	NO
CVE-2013-5358HIGH Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag, as demonstrated using a KDC file with a DSLR-A10	Jan 9, 2014	7.5	19	NO	NO
CVE-2007-4823HIGH Multiple buffer overflows in Google Picasa have unspecified attack vectors and impact. NOTE: this information is based upon a vague pre-advisory.	Sep 11, 2007	7.5	19	NO	NO
CVE-2007-4824MEDIUM Multiple cross-application scripting (XAS) vulnerabilities in Google Picasa have unspecified attack vectors and impact. NOTE: this information is based upon a vague pre-advisory.	Sep 11, 2007	6.8	18	NO	NO

View all 11 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (11 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (11 CVEs).

Media Mentions

Signals from CVEs in this product scope (11 CVEs).

Top CNAs Publishing CVEs For Picasa

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
3.9.140	1	10.0	4.0%
3.9.0	4	7.5	2.1%
3.6_build_95.25	1	9.3	4.3%
3.6_build_105.61	1	9.3	4.3%
3.6_build_105.41	1	9.3	4.3%
3.5_build_95.18	1	9.3	4.3%
3.5_build_79.81	1	9.3	4.3%
3.5_build_79.74	1	9.3	4.3%
3.5_build_79.69	1	9.3	4.3%
3.5_build_79.67	1	9.3	4.3%
3.5	1	9.3	4.3%