Bug 479560 (CVE-2009-0135, CVE-2009-0136)
| Summary: | CVE-2009-0135 CVE-2009-0136 amarok: multiple buffer overflows when parsing Audible .aa files | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | gauret, jlieskov, rdieter, vdanen |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-04-22 17:36:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Tomas Hoger
2009-01-11 10:46:50 UTC
Keeping this bug restricted for now, as upstream only plan to announce it later today. Will add bug to already submitted update request once this is public. Public now via: http://amarok.kde.org/en/releases/2.0.1.1 http://www.trapkit.de/advisories/TKADV2009-002.txt *** Bug 479946 has been marked as a duplicate of this bug. *** amarok-2.0.1.1-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report. Related CVE assignments: CVE-2009-0135: Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow. CVE-2009-0136: Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure. amarok-1.4.10-2.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report. This has also been corrected in EPEL5: * Mon Jan 12 2009 Rex Dieter <rdieter> - 1.4.10-2 - backport security patch |