Explain CVE-2009-0136
Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure.
Affected Products: n/a
References: [{'name': 'DSA-1706', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1706'}, {'name': 'USN-739-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-739-1'}, {'name': 'ADV-2009-0100', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0100'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://websvn.kde.org/?view=rev&revision=908391'}, {'name': '33522', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33522'}, {'name': 'GLSA-200903-34', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200903-34.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://websvn.kde.org/?view=rev&revision=908415'}, {'name': 'FEDORA-2009-0715', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html'}, {'name': 'SUSE-SR:2009:003', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html'}, {'name': '33505', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33505'}, {'name': 'MDVSA-2009:030', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:030'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=479560'}, {'name': '[oss-security] 20090114 CVE Request -- amarok', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2009/01/14/2'}, {'name': '34315', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=479946'}, {'tags': ['x_refsource_MISC'], 'url': 'http://trapkit.de/advisories/TKADV2009-002.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://amarok.kde.org/en/releases/2.0.1.1'}, {'name': '20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/499984/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://websvn.kde.org/?view=rev&revision=908401'}, {'name': '34407', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34407'}, {'name': '33640', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33640'}, {'name': '4915', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/4915'}, {'name': '33210', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33210'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=254896'}, {'name': '1021558', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021558'}, {'name': '33819', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33819'}]
CVE State: PUBLISHED