CVE-2007-1922: Input Validation

Published Apr 10, 2007

Updated

The Impulse Tracker (IT) and ScreamTracker 3 (S3M) modules in INMOD.DLL in AOL Nullsoft Winamp 5.33 allows remote attackers to execute arbitrary code via a crafted (1) .IT or (2) .S3M file containing integer values that are used as memory offsets, which triggers memory corruption.

Affected Software

1 affected component

Nullsoft Winamp=5.33

Remediation

Patch Available

http://www.piotrbania.com/all/adv/nullsoft-winamp-it_module-in_mod-adv.txt

Event History

Apr 10, 2007

CVE Published

11:19 PM

Apr 11, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1922?

CVE-2007-1922 has a high severity rating due to the potential for remote code execution.

How do I fix CVE-2007-1922?

To fix CVE-2007-1922, you should upgrade to a newer version of Winamp that is not affected by this vulnerability.

Who is affected by CVE-2007-1922?

CVE-2007-1922 affects users of Winamp version 5.33 specifically when playing .IT and .S3M files.

What types of files are involved in CVE-2007-1922?

CVE-2007-1922 involves crafted .IT and .S3M files that exploit memory corruption issues.

Can CVE-2007-1922 be exploited remotely?

Yes, CVE-2007-1922 can be exploited remotely by attackers through specially crafted audio files.