CVE-2006-0708: Buffer Overflow

Published Feb 15, 2006

Updated

Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via (1) an m3u file containing a long URL ending in .wma, (2) a pls file containing a File1 field with a long URL ending in .wma, or (3) an m3u file with a long filename, variants of CVE-2005-3188 and CVE-2006-0476.

Affected Software

18 affected components

Nullsoft Winamp=5.093

Nullsoft Winamp=5.09

Nullsoft Winamp=5.05

Nullsoft Winamp=5.02

Nullsoft Winamp=5.01

Nullsoft Winamp=5.12

Nullsoft Winamp=5.094

Nullsoft Winamp=5.04

Nullsoft Winamp=5.08d

Nullsoft Winamp=5.11

Nullsoft Winamp=5.06

Nullsoft Winamp=5.07

Nullsoft Winamp=5.13

Nullsoft Winamp=5.091

Nullsoft Winamp=5.03

Nullsoft Winamp=5.0

Nullsoft Winamp=5.08e

Nullsoft Winamp=5.08c

Event History

Feb 15, 2006

CVE Published

11:06 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0708?

CVE-2006-0708 has a high severity rating due to its potential to allow remote code execution.

How do I fix CVE-2006-0708?

To fix CVE-2006-0708, update NullSoft Winamp to version 5.14 or later where the vulnerability has been patched.

What versions of NullSoft Winamp are affected by CVE-2006-0708?

CVE-2006-0708 affects NullSoft Winamp versions 5.0 through 5.13.

Can CVE-2006-0708 be exploited remotely?

Yes, CVE-2006-0708 can be exploited remotely by attackers through specially crafted media playlist files.

What are the attack vectors for CVE-2006-0708?

The attack vectors for CVE-2006-0708 include m3u files with long URLs and pls files with long fields.