CVE-2009-0186: Buffer Overflow
Published Mar 5, 2009
·Updated
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
Affected Software
25 affected components
Nullsoft Winamp=5.55
Nullsoft Winamp=5.541
mega-nerd libsndfile<=1.0.18
mega-nerd libsndfile=0.0.8
mega-nerd libsndfile=0.0.28
mega-nerd libsndfile=1.0.0
mega-nerd libsndfile=1.0.0-rc1
mega-nerd libsndfile=1.0.0-rc6
mega-nerd libsndfile=1.0.1
mega-nerd libsndfile=1.0.2
mega-nerd libsndfile=1.0.3
mega-nerd libsndfile=1.0.4
mega-nerd libsndfile=1.0.5
mega-nerd libsndfile=1.0.6
mega-nerd libsndfile=1.0.7
mega-nerd libsndfile=1.0.8
mega-nerd libsndfile=1.0.9
mega-nerd libsndfile=1.0.10
mega-nerd libsndfile=1.0.11
mega-nerd libsndfile=1.0.12
mega-nerd libsndfile=1.0.13
mega-nerd libsndfile=1.0.14
mega-nerd libsndfile=1.0.15
mega-nerd libsndfile=1.0.16
mega-nerd libsndfile=1.0.17
Event History
Mar 5, 2009
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Data Sourced
via NVD·02:30 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-0186?
The severity of CVE-2009-0186 is considered high due to its potential to allow arbitrary code execution.
2
How do I fix CVE-2009-0186?
To fix CVE-2009-0186, upgrade libsndfile to version 1.0.19 or later.
3
What products are affected by CVE-2009-0186?
CVE-2009-0186 affects multiple versions of libsndfile up to and including 1.0.18 and specific versions of Winamp.
4
What type of attack can exploit CVE-2009-0186?
CVE-2009-0186 can be exploited by context-dependent attackers using crafted CAF audio files.
5
Is CVE-2009-0186 a buffer overflow vulnerability?
Yes, CVE-2009-0186 is a buffer overflow vulnerability caused by an integer overflow in libsndfile.