CVE-2009-2206: Buffer Overflow
Multiple heap-based buffer overflows in the AudioCodecs library in the CoreAudio component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted (1) AAC or (2) MP3 file, as demonstrated by a ringtone with malformed entries in the sample size table.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2206?
CVE-2009-2206 is classified as a high severity vulnerability due to the potential for remote code execution or denial of service.
How do I fix CVE-2009-2206?
To fix CVE-2009-2206, users should update their Apple iPhone OS to version 3.1 or later.
What software is affected by CVE-2009-2206?
CVE-2009-2206 affects Apple iPhone OS versions before 3.1 and certain older versions of iPod touch.
What type of attack does CVE-2009-2206 enable?
CVE-2009-2206 allows attackers to execute arbitrary code or cause application crashes through specially crafted AAC or MP3 files.
When was CVE-2009-2206 disclosed?
CVE-2009-2206 was disclosed in September 2009.