Joined: 12 May 2004
|Posted: Fri Mar 20, 2009 9:26 pm Post subject: [ GLSA 200903-34 ] Amarok: User-assisted execution of arbitr
|Gentoo Linux Security Advisory
Title: Amarok: User-assisted execution of arbitrary code (GLSA 200903-34)
Date: March 20, 2009
Multiple vulnerabilities in Amarok might allow for user-assisted execution of arbitrary code.
Amarok is an advanced music player.
Vulnerable: < 1.4.10-r2
Unaffected: >= 1.4.10-r2
Architectures: All supported architectures
Tobias Klein has discovered multiple vulnerabilities in Amarok:
- Multiple integer overflows in the Audible::Tag::readTag() function in metadata/audible/audibletag.cpp trigger heap-based buffer overflows (CVE-2009-0135).
- Multiple array index errors in the Audible::Tag::readTag() function in metadata/audible/audibletag.cpp can lead to invalid pointer dereferences, or the writing of a 0x00 byte to an arbitrary memory location after an allocation failure (CVE-2009-0136).
A remote attacker could entice a user to open a specially crafted Audible Audio (.aa) file with a large "nlen" or "vlen" tag value to execute arbitrary code or cause a Denial of Service.
There is no known workaround at this time.
All Amarok users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=media-sound/amarok-1.4.10-r2"