Search

Find a vulnerability

Search criteria

    10 vulnerabilities by amarok

    CVE-2009-0136 (GCVE-0-2009-0136)

    Vulnerability from nvd – Published: 2009-01-16 18:00 – Updated: 2024-08-07 04:24
    VLAI
    Summary
    Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://www.debian.org/security/2009/dsa-1706 vendor-advisoryx_refsource_DEBIAN
    http://www.ubuntu.com/usn/USN-739-1 vendor-advisoryx_refsource_UBUNTU
    http://www.vupen.com/english/advisories/2009/0100 vdb-entryx_refsource_VUPEN
    http://websvn.kde.org/?view=rev&revision=908391 x_refsource_CONFIRM
    http://secunia.com/advisories/33522 third-party-advisoryx_refsource_SECUNIA
    http://security.gentoo.org/glsa/glsa-200903-34.xml vendor-advisoryx_refsource_GENTOO
    http://websvn.kde.org/?view=rev&revision=908415 x_refsource_CONFIRM
    https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
    http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
    http://secunia.com/advisories/33505 third-party-advisoryx_refsource_SECUNIA
    http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
    https://bugzilla.redhat.com/show_bug.cgi?id=479560 x_refsource_CONFIRM
    http://openwall.com/lists/oss-security/2009/01/14/2 mailing-listx_refsource_MLIST
    http://secunia.com/advisories/34315 third-party-advisoryx_refsource_SECUNIA
    https://bugzilla.redhat.com/show_bug.cgi?id=479946 x_refsource_CONFIRM
    http://trapkit.de/advisories/TKADV2009-002.txt x_refsource_MISC
    http://amarok.kde.org/en/releases/2.0.1.1 x_refsource_CONFIRM
    http://www.securityfocus.com/archive/1/499984/100… mailing-listx_refsource_BUGTRAQ
    http://websvn.kde.org/?view=rev&revision=908401 x_refsource_CONFIRM
    http://secunia.com/advisories/34407 third-party-advisoryx_refsource_SECUNIA
    http://secunia.com/advisories/33640 third-party-advisoryx_refsource_SECUNIA
    http://securityreason.com/securityalert/4915 third-party-advisoryx_refsource_SREASON
    http://www.securityfocus.com/bid/33210 vdb-entryx_refsource_BID
    http://bugs.gentoo.org/show_bug.cgi?id=254896 x_refsource_CONFIRM
    http://www.securitytracker.com/id?1021558 vdb-entryx_refsource_SECTRACK
    http://secunia.com/advisories/33819 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2009-01-11 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:24:18.392Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-1706",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1706"
          },
          {
            "name": "USN-739-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-739-1"
          },
          {
            "name": "ADV-2009-0100",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0100"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
          },
          {
            "name": "33522",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33522"
          },
          {
            "name": "GLSA-200903-34",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
          },
          {
            "name": "FEDORA-2009-0715",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
          },
          {
            "name": "SUSE-SR:2009:003",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
          },
          {
            "name": "33505",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33505"
          },
          {
            "name": "MDVSA-2009:030",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
          },
          {
            "name": "[oss-security] 20090114 CVE Request -- amarok",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
          },
          {
            "name": "34315",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34315"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://amarok.kde.org/en/releases/2.0.1.1"
          },
          {
            "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
          },
          {
            "name": "34407",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34407"
          },
          {
            "name": "33640",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33640"
          },
          {
            "name": "4915",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4915"
          },
          {
            "name": "33210",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33210"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
          },
          {
            "name": "1021558",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021558"
          },
          {
            "name": "33819",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33819"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-01-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-1706",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1706"
        },
        {
          "name": "USN-739-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-739-1"
        },
        {
          "name": "ADV-2009-0100",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0100"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
        },
        {
          "name": "33522",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33522"
        },
        {
          "name": "GLSA-200903-34",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
        },
        {
          "name": "FEDORA-2009-0715",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
        },
        {
          "name": "SUSE-SR:2009:003",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
        },
        {
          "name": "33505",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33505"
        },
        {
          "name": "MDVSA-2009:030",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
        },
        {
          "name": "[oss-security] 20090114 CVE Request -- amarok",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
        },
        {
          "name": "34315",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34315"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://amarok.kde.org/en/releases/2.0.1.1"
        },
        {
          "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
        },
        {
          "name": "34407",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34407"
        },
        {
          "name": "33640",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33640"
        },
        {
          "name": "4915",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4915"
        },
        {
          "name": "33210",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33210"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
        },
        {
          "name": "1021558",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021558"
        },
        {
          "name": "33819",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33819"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0136",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-1706",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1706"
            },
            {
              "name": "USN-739-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-739-1"
            },
            {
              "name": "ADV-2009-0100",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0100"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908391",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
            },
            {
              "name": "33522",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33522"
            },
            {
              "name": "GLSA-200903-34",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908415",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
            },
            {
              "name": "FEDORA-2009-0715",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
            },
            {
              "name": "SUSE-SR:2009:003",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
            },
            {
              "name": "33505",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33505"
            },
            {
              "name": "MDVSA-2009:030",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=479560",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
            },
            {
              "name": "[oss-security] 20090114 CVE Request -- amarok",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
            },
            {
              "name": "34315",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34315"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=479946",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
            },
            {
              "name": "http://trapkit.de/advisories/TKADV2009-002.txt",
              "refsource": "MISC",
              "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
            },
            {
              "name": "http://amarok.kde.org/en/releases/2.0.1.1",
              "refsource": "CONFIRM",
              "url": "http://amarok.kde.org/en/releases/2.0.1.1"
            },
            {
              "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908401",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
            },
            {
              "name": "34407",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34407"
            },
            {
              "name": "33640",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33640"
            },
            {
              "name": "4915",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4915"
            },
            {
              "name": "33210",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/33210"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=254896",
              "refsource": "CONFIRM",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
            },
            {
              "name": "1021558",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1021558"
            },
            {
              "name": "33819",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33819"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0136",
    "datePublished": "2009-01-16T18:00:00.000Z",
    "dateReserved": "2009-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-07T04:24:18.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2009-0135 (GCVE-0-2009-0135)

    Vulnerability from nvd – Published: 2009-01-16 18:00 – Updated: 2024-08-07 04:24
    VLAI
    Summary
    Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://www.debian.org/security/2009/dsa-1706 vendor-advisoryx_refsource_DEBIAN
    http://www.ubuntu.com/usn/USN-739-1 vendor-advisoryx_refsource_UBUNTU
    http://www.vupen.com/english/advisories/2009/0100 vdb-entryx_refsource_VUPEN
    http://websvn.kde.org/?view=rev&revision=908391 x_refsource_CONFIRM
    http://secunia.com/advisories/33522 third-party-advisoryx_refsource_SECUNIA
    http://security.gentoo.org/glsa/glsa-200903-34.xml vendor-advisoryx_refsource_GENTOO
    http://websvn.kde.org/?view=rev&revision=908415 x_refsource_CONFIRM
    https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
    http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
    http://secunia.com/advisories/33505 third-party-advisoryx_refsource_SECUNIA
    http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
    https://bugzilla.redhat.com/show_bug.cgi?id=479560 x_refsource_CONFIRM
    http://openwall.com/lists/oss-security/2009/01/14/2 mailing-listx_refsource_MLIST
    http://secunia.com/advisories/34315 third-party-advisoryx_refsource_SECUNIA
    https://bugzilla.redhat.com/show_bug.cgi?id=479946 x_refsource_CONFIRM
    http://trapkit.de/advisories/TKADV2009-002.txt x_refsource_MISC
    http://amarok.kde.org/en/releases/2.0.1.1 x_refsource_CONFIRM
    http://www.securityfocus.com/archive/1/499984/100… mailing-listx_refsource_BUGTRAQ
    http://websvn.kde.org/?view=rev&revision=908401 x_refsource_CONFIRM
    http://secunia.com/advisories/34407 third-party-advisoryx_refsource_SECUNIA
    http://secunia.com/advisories/33640 third-party-advisoryx_refsource_SECUNIA
    http://securityreason.com/securityalert/4915 third-party-advisoryx_refsource_SREASON
    http://www.securityfocus.com/bid/33210 vdb-entryx_refsource_BID
    http://bugs.gentoo.org/show_bug.cgi?id=254896 x_refsource_CONFIRM
    http://www.securitytracker.com/id?1021558 vdb-entryx_refsource_SECTRACK
    http://secunia.com/advisories/33819 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2009-01-11 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:24:18.248Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-1706",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1706"
          },
          {
            "name": "USN-739-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-739-1"
          },
          {
            "name": "ADV-2009-0100",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0100"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
          },
          {
            "name": "33522",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33522"
          },
          {
            "name": "GLSA-200903-34",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
          },
          {
            "name": "FEDORA-2009-0715",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
          },
          {
            "name": "SUSE-SR:2009:003",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
          },
          {
            "name": "33505",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33505"
          },
          {
            "name": "MDVSA-2009:030",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
          },
          {
            "name": "[oss-security] 20090114 CVE Request -- amarok",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
          },
          {
            "name": "34315",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34315"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://amarok.kde.org/en/releases/2.0.1.1"
          },
          {
            "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
          },
          {
            "name": "34407",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34407"
          },
          {
            "name": "33640",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33640"
          },
          {
            "name": "4915",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4915"
          },
          {
            "name": "33210",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33210"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
          },
          {
            "name": "1021558",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021558"
          },
          {
            "name": "33819",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33819"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-01-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-1706",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1706"
        },
        {
          "name": "USN-739-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-739-1"
        },
        {
          "name": "ADV-2009-0100",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0100"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
        },
        {
          "name": "33522",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33522"
        },
        {
          "name": "GLSA-200903-34",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
        },
        {
          "name": "FEDORA-2009-0715",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
        },
        {
          "name": "SUSE-SR:2009:003",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
        },
        {
          "name": "33505",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33505"
        },
        {
          "name": "MDVSA-2009:030",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
        },
        {
          "name": "[oss-security] 20090114 CVE Request -- amarok",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
        },
        {
          "name": "34315",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34315"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://amarok.kde.org/en/releases/2.0.1.1"
        },
        {
          "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
        },
        {
          "name": "34407",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34407"
        },
        {
          "name": "33640",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33640"
        },
        {
          "name": "4915",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4915"
        },
        {
          "name": "33210",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33210"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
        },
        {
          "name": "1021558",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021558"
        },
        {
          "name": "33819",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33819"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0135",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-1706",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1706"
            },
            {
              "name": "USN-739-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-739-1"
            },
            {
              "name": "ADV-2009-0100",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0100"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908391",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
            },
            {
              "name": "33522",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33522"
            },
            {
              "name": "GLSA-200903-34",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908415",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
            },
            {
              "name": "FEDORA-2009-0715",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
            },
            {
              "name": "SUSE-SR:2009:003",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
            },
            {
              "name": "33505",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33505"
            },
            {
              "name": "MDVSA-2009:030",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=479560",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
            },
            {
              "name": "[oss-security] 20090114 CVE Request -- amarok",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
            },
            {
              "name": "34315",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34315"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=479946",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
            },
            {
              "name": "http://trapkit.de/advisories/TKADV2009-002.txt",
              "refsource": "MISC",
              "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
            },
            {
              "name": "http://amarok.kde.org/en/releases/2.0.1.1",
              "refsource": "CONFIRM",
              "url": "http://amarok.kde.org/en/releases/2.0.1.1"
            },
            {
              "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908401",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
            },
            {
              "name": "34407",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34407"
            },
            {
              "name": "33640",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33640"
            },
            {
              "name": "4915",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4915"
            },
            {
              "name": "33210",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/33210"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=254896",
              "refsource": "CONFIRM",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
            },
            {
              "name": "1021558",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1021558"
            },
            {
              "name": "33819",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33819"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0135",
    "datePublished": "2009-01-16T18:00:00.000Z",
    "dateReserved": "2009-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-07T04:24:18.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3699 (GCVE-0-2008-3699)

    Vulnerability from nvd – Published: 2008-08-14 23:00 – Updated: 2024-08-07 09:45
    VLAI
    Summary
    The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://secunia.com/advisories/32357 third-party-advisoryx_refsource_SECUNIA
    http://websvn.kde.org/?view=rev&revision=846626 x_refsource_CONFIRM
    http://secunia.com/advisories/31418 third-party-advisoryx_refsource_SECUNIA
    http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
    http://www.ubuntu.com/usn/usn-657-1 vendor-advisoryx_refsource_UBUNTU
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765 x_refsource_MISC
    http://amarok.kde.org/en/releases/1/4/10 x_refsource_CONFIRM
    https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
    http://www.vupen.com/english/advisories/2008/2338 vdb-entryx_refsource_VUPEN
    http://secunia.com/advisories/31663 third-party-advisoryx_refsource_SECUNIA
    http://security.gentoo.org/glsa/glsa-200809-08.xml vendor-advisoryx_refsource_GENTOO
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://slackware.com/security/viewer.php?l=slackw… vendor-advisoryx_refsource_SLACKWARE
    http://www.securityfocus.com/bid/30662 vdb-entryx_refsource_BID
    https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
    http://secunia.com/advisories/31839 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2008-08-11 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:45:19.215Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "32357",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32357"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
          },
          {
            "name": "31418",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31418"
          },
          {
            "name": "MDVSA-2008:172",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
          },
          {
            "name": "USN-657-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-657-1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://amarok.kde.org/en/releases/1/4/10"
          },
          {
            "name": "FEDORA-2008-7739",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
          },
          {
            "name": "ADV-2008-2338",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2338"
          },
          {
            "name": "31663",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31663"
          },
          {
            "name": "GLSA-200809-08",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
          },
          {
            "name": "amarok-magnatunebrowser-symlink(44399)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
          },
          {
            "name": "SSA:2008-241-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
          },
          {
            "name": "30662",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30662"
          },
          {
            "name": "FEDORA-2008-7719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
          },
          {
            "name": "31839",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31839"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-08-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "32357",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32357"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
        },
        {
          "name": "31418",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31418"
        },
        {
          "name": "MDVSA-2008:172",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
        },
        {
          "name": "USN-657-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-657-1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://amarok.kde.org/en/releases/1/4/10"
        },
        {
          "name": "FEDORA-2008-7739",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
        },
        {
          "name": "ADV-2008-2338",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2338"
        },
        {
          "name": "31663",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31663"
        },
        {
          "name": "GLSA-200809-08",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
        },
        {
          "name": "amarok-magnatunebrowser-symlink(44399)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
        },
        {
          "name": "SSA:2008-241-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
        },
        {
          "name": "30662",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30662"
        },
        {
          "name": "FEDORA-2008-7719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
        },
        {
          "name": "31839",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31839"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3699",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "32357",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32357"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=846626",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
            },
            {
              "name": "31418",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31418"
            },
            {
              "name": "MDVSA-2008:172",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
            },
            {
              "name": "USN-657-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-657-1"
            },
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765",
              "refsource": "MISC",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
            },
            {
              "name": "http://amarok.kde.org/en/releases/1/4/10",
              "refsource": "CONFIRM",
              "url": "http://amarok.kde.org/en/releases/1/4/10"
            },
            {
              "name": "FEDORA-2008-7739",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
            },
            {
              "name": "ADV-2008-2338",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2338"
            },
            {
              "name": "31663",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31663"
            },
            {
              "name": "GLSA-200809-08",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
            },
            {
              "name": "amarok-magnatunebrowser-symlink(44399)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
            },
            {
              "name": "SSA:2008-241-01",
              "refsource": "SLACKWARE",
              "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
            },
            {
              "name": "30662",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30662"
            },
            {
              "name": "FEDORA-2008-7719",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
            },
            {
              "name": "31839",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31839"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3699",
    "datePublished": "2008-08-14T23:00:00.000Z",
    "dateReserved": "2008-08-14T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:45:19.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2006-6979 (GCVE-0-2006-6979)

    Vulnerability from nvd – Published: 2007-02-08 18:00 – Updated: 2024-08-07 20:50
    VLAI
    Summary
    The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://secunia.com/advisories/23984 third-party-advisoryx_refsource_SECUNIA
    http://www.vupen.com/english/advisories/2007/0613 vdb-entryx_refsource_VUPEN
    http://lists.suse.com/archive/suse-security-annou… vendor-advisoryx_refsource_SUSE
    http://bugs.gentoo.org/show_bug.cgi?id=166901 x_refsource_MISC
    http://secunia.com/advisories/24510 third-party-advisoryx_refsource_SECUNIA
    http://www.securityfocus.com/bid/22568 vdb-entryx_refsource_BID
    http://bugs.kde.org/show_bug.cgi?id=138499 x_refsource_MISC
    http://security.gentoo.org/glsa/glsa-200703-11.xml vendor-advisoryx_refsource_GENTOO
    http://secunia.com/advisories/24159 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2006-01-27 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T20:50:04.608Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "23984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23984"
          },
          {
            "name": "ADV-2007-0613",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/0613"
          },
          {
            "name": "SUSE-SR:2007:002",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
          },
          {
            "name": "24510",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/24510"
          },
          {
            "name": "22568",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/22568"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.kde.org/show_bug.cgi?id=138499"
          },
          {
            "name": "GLSA-200703-11",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
          },
          {
            "name": "24159",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/24159"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2007-02-16T10:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "23984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23984"
        },
        {
          "name": "ADV-2007-0613",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/0613"
        },
        {
          "name": "SUSE-SR:2007:002",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
        },
        {
          "name": "24510",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/24510"
        },
        {
          "name": "22568",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/22568"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.kde.org/show_bug.cgi?id=138499"
        },
        {
          "name": "GLSA-200703-11",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
        },
        {
          "name": "24159",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/24159"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-6979",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "23984",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23984"
            },
            {
              "name": "ADV-2007-0613",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/0613"
            },
            {
              "name": "SUSE-SR:2007:002",
              "refsource": "SUSE",
              "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=166901",
              "refsource": "MISC",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
            },
            {
              "name": "24510",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/24510"
            },
            {
              "name": "22568",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/22568"
            },
            {
              "name": "http://bugs.kde.org/show_bug.cgi?id=138499",
              "refsource": "MISC",
              "url": "http://bugs.kde.org/show_bug.cgi?id=138499"
            },
            {
              "name": "GLSA-200703-11",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
            },
            {
              "name": "24159",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/24159"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-6979",
    "datePublished": "2007-02-08T18:00:00.000Z",
    "dateReserved": "2007-02-08T00:00:00.000Z",
    "dateUpdated": "2024-08-07T20:50:04.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2005-2029 (GCVE-0-2005-2029)

    Vulnerability from nvd – Published: 2005-06-21 04:00 – Updated: 2024-09-17 04:04
    VLAI
    Summary
    amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://secunia.com/advisories/15736 third-party-advisoryx_refsource_SECUNIA
    http://sourceforge.net/project/shownotes.php?rele… x_refsource_CONFIRM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T22:15:36.796Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "15736",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/15736"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2005-06-21T04:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "15736",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/15736"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-2029",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "15736",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/15736"
            },
            {
              "name": "http://sourceforge.net/project/shownotes.php?release_id=335719",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-2029",
    "datePublished": "2005-06-21T04:00:00.000Z",
    "dateReserved": "2005-06-21T00:00:00.000Z",
    "dateUpdated": "2024-09-17T04:04:49.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2009-0135 (GCVE-0-2009-0135)

    Vulnerability from cvelistv5 – Published: 2009-01-16 18:00 – Updated: 2024-08-07 04:24
    VLAI
    Summary
    Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://www.debian.org/security/2009/dsa-1706 vendor-advisoryx_refsource_DEBIAN
    http://www.ubuntu.com/usn/USN-739-1 vendor-advisoryx_refsource_UBUNTU
    http://www.vupen.com/english/advisories/2009/0100 vdb-entryx_refsource_VUPEN
    http://websvn.kde.org/?view=rev&revision=908391 x_refsource_CONFIRM
    http://secunia.com/advisories/33522 third-party-advisoryx_refsource_SECUNIA
    http://security.gentoo.org/glsa/glsa-200903-34.xml vendor-advisoryx_refsource_GENTOO
    http://websvn.kde.org/?view=rev&revision=908415 x_refsource_CONFIRM
    https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
    http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
    http://secunia.com/advisories/33505 third-party-advisoryx_refsource_SECUNIA
    http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
    https://bugzilla.redhat.com/show_bug.cgi?id=479560 x_refsource_CONFIRM
    http://openwall.com/lists/oss-security/2009/01/14/2 mailing-listx_refsource_MLIST
    http://secunia.com/advisories/34315 third-party-advisoryx_refsource_SECUNIA
    https://bugzilla.redhat.com/show_bug.cgi?id=479946 x_refsource_CONFIRM
    http://trapkit.de/advisories/TKADV2009-002.txt x_refsource_MISC
    http://amarok.kde.org/en/releases/2.0.1.1 x_refsource_CONFIRM
    http://www.securityfocus.com/archive/1/499984/100… mailing-listx_refsource_BUGTRAQ
    http://websvn.kde.org/?view=rev&revision=908401 x_refsource_CONFIRM
    http://secunia.com/advisories/34407 third-party-advisoryx_refsource_SECUNIA
    http://secunia.com/advisories/33640 third-party-advisoryx_refsource_SECUNIA
    http://securityreason.com/securityalert/4915 third-party-advisoryx_refsource_SREASON
    http://www.securityfocus.com/bid/33210 vdb-entryx_refsource_BID
    http://bugs.gentoo.org/show_bug.cgi?id=254896 x_refsource_CONFIRM
    http://www.securitytracker.com/id?1021558 vdb-entryx_refsource_SECTRACK
    http://secunia.com/advisories/33819 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2009-01-11 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:24:18.248Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-1706",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1706"
          },
          {
            "name": "USN-739-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-739-1"
          },
          {
            "name": "ADV-2009-0100",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0100"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
          },
          {
            "name": "33522",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33522"
          },
          {
            "name": "GLSA-200903-34",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
          },
          {
            "name": "FEDORA-2009-0715",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
          },
          {
            "name": "SUSE-SR:2009:003",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
          },
          {
            "name": "33505",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33505"
          },
          {
            "name": "MDVSA-2009:030",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
          },
          {
            "name": "[oss-security] 20090114 CVE Request -- amarok",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
          },
          {
            "name": "34315",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34315"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://amarok.kde.org/en/releases/2.0.1.1"
          },
          {
            "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
          },
          {
            "name": "34407",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34407"
          },
          {
            "name": "33640",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33640"
          },
          {
            "name": "4915",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4915"
          },
          {
            "name": "33210",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33210"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
          },
          {
            "name": "1021558",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021558"
          },
          {
            "name": "33819",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33819"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-01-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-1706",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1706"
        },
        {
          "name": "USN-739-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-739-1"
        },
        {
          "name": "ADV-2009-0100",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0100"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
        },
        {
          "name": "33522",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33522"
        },
        {
          "name": "GLSA-200903-34",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
        },
        {
          "name": "FEDORA-2009-0715",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
        },
        {
          "name": "SUSE-SR:2009:003",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
        },
        {
          "name": "33505",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33505"
        },
        {
          "name": "MDVSA-2009:030",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
        },
        {
          "name": "[oss-security] 20090114 CVE Request -- amarok",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
        },
        {
          "name": "34315",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34315"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://amarok.kde.org/en/releases/2.0.1.1"
        },
        {
          "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
        },
        {
          "name": "34407",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34407"
        },
        {
          "name": "33640",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33640"
        },
        {
          "name": "4915",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4915"
        },
        {
          "name": "33210",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33210"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
        },
        {
          "name": "1021558",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021558"
        },
        {
          "name": "33819",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33819"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0135",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-1706",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1706"
            },
            {
              "name": "USN-739-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-739-1"
            },
            {
              "name": "ADV-2009-0100",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0100"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908391",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
            },
            {
              "name": "33522",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33522"
            },
            {
              "name": "GLSA-200903-34",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908415",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
            },
            {
              "name": "FEDORA-2009-0715",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
            },
            {
              "name": "SUSE-SR:2009:003",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
            },
            {
              "name": "33505",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33505"
            },
            {
              "name": "MDVSA-2009:030",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=479560",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
            },
            {
              "name": "[oss-security] 20090114 CVE Request -- amarok",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
            },
            {
              "name": "34315",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34315"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=479946",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
            },
            {
              "name": "http://trapkit.de/advisories/TKADV2009-002.txt",
              "refsource": "MISC",
              "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
            },
            {
              "name": "http://amarok.kde.org/en/releases/2.0.1.1",
              "refsource": "CONFIRM",
              "url": "http://amarok.kde.org/en/releases/2.0.1.1"
            },
            {
              "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908401",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
            },
            {
              "name": "34407",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34407"
            },
            {
              "name": "33640",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33640"
            },
            {
              "name": "4915",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4915"
            },
            {
              "name": "33210",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/33210"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=254896",
              "refsource": "CONFIRM",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
            },
            {
              "name": "1021558",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1021558"
            },
            {
              "name": "33819",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33819"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0135",
    "datePublished": "2009-01-16T18:00:00.000Z",
    "dateReserved": "2009-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-07T04:24:18.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2009-0136 (GCVE-0-2009-0136)

    Vulnerability from cvelistv5 – Published: 2009-01-16 18:00 – Updated: 2024-08-07 04:24
    VLAI
    Summary
    Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://www.debian.org/security/2009/dsa-1706 vendor-advisoryx_refsource_DEBIAN
    http://www.ubuntu.com/usn/USN-739-1 vendor-advisoryx_refsource_UBUNTU
    http://www.vupen.com/english/advisories/2009/0100 vdb-entryx_refsource_VUPEN
    http://websvn.kde.org/?view=rev&revision=908391 x_refsource_CONFIRM
    http://secunia.com/advisories/33522 third-party-advisoryx_refsource_SECUNIA
    http://security.gentoo.org/glsa/glsa-200903-34.xml vendor-advisoryx_refsource_GENTOO
    http://websvn.kde.org/?view=rev&revision=908415 x_refsource_CONFIRM
    https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
    http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
    http://secunia.com/advisories/33505 third-party-advisoryx_refsource_SECUNIA
    http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
    https://bugzilla.redhat.com/show_bug.cgi?id=479560 x_refsource_CONFIRM
    http://openwall.com/lists/oss-security/2009/01/14/2 mailing-listx_refsource_MLIST
    http://secunia.com/advisories/34315 third-party-advisoryx_refsource_SECUNIA
    https://bugzilla.redhat.com/show_bug.cgi?id=479946 x_refsource_CONFIRM
    http://trapkit.de/advisories/TKADV2009-002.txt x_refsource_MISC
    http://amarok.kde.org/en/releases/2.0.1.1 x_refsource_CONFIRM
    http://www.securityfocus.com/archive/1/499984/100… mailing-listx_refsource_BUGTRAQ
    http://websvn.kde.org/?view=rev&revision=908401 x_refsource_CONFIRM
    http://secunia.com/advisories/34407 third-party-advisoryx_refsource_SECUNIA
    http://secunia.com/advisories/33640 third-party-advisoryx_refsource_SECUNIA
    http://securityreason.com/securityalert/4915 third-party-advisoryx_refsource_SREASON
    http://www.securityfocus.com/bid/33210 vdb-entryx_refsource_BID
    http://bugs.gentoo.org/show_bug.cgi?id=254896 x_refsource_CONFIRM
    http://www.securitytracker.com/id?1021558 vdb-entryx_refsource_SECTRACK
    http://secunia.com/advisories/33819 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2009-01-11 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:24:18.392Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-1706",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1706"
          },
          {
            "name": "USN-739-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-739-1"
          },
          {
            "name": "ADV-2009-0100",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0100"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
          },
          {
            "name": "33522",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33522"
          },
          {
            "name": "GLSA-200903-34",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
          },
          {
            "name": "FEDORA-2009-0715",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
          },
          {
            "name": "SUSE-SR:2009:003",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
          },
          {
            "name": "33505",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33505"
          },
          {
            "name": "MDVSA-2009:030",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
          },
          {
            "name": "[oss-security] 20090114 CVE Request -- amarok",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
          },
          {
            "name": "34315",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34315"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://amarok.kde.org/en/releases/2.0.1.1"
          },
          {
            "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
          },
          {
            "name": "34407",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34407"
          },
          {
            "name": "33640",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33640"
          },
          {
            "name": "4915",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4915"
          },
          {
            "name": "33210",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33210"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
          },
          {
            "name": "1021558",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021558"
          },
          {
            "name": "33819",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33819"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-01-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-1706",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1706"
        },
        {
          "name": "USN-739-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-739-1"
        },
        {
          "name": "ADV-2009-0100",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0100"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
        },
        {
          "name": "33522",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33522"
        },
        {
          "name": "GLSA-200903-34",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
        },
        {
          "name": "FEDORA-2009-0715",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
        },
        {
          "name": "SUSE-SR:2009:003",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
        },
        {
          "name": "33505",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33505"
        },
        {
          "name": "MDVSA-2009:030",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
        },
        {
          "name": "[oss-security] 20090114 CVE Request -- amarok",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
        },
        {
          "name": "34315",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34315"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://amarok.kde.org/en/releases/2.0.1.1"
        },
        {
          "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
        },
        {
          "name": "34407",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34407"
        },
        {
          "name": "33640",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33640"
        },
        {
          "name": "4915",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4915"
        },
        {
          "name": "33210",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33210"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
        },
        {
          "name": "1021558",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021558"
        },
        {
          "name": "33819",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33819"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0136",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-1706",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1706"
            },
            {
              "name": "USN-739-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-739-1"
            },
            {
              "name": "ADV-2009-0100",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0100"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908391",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
            },
            {
              "name": "33522",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33522"
            },
            {
              "name": "GLSA-200903-34",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908415",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
            },
            {
              "name": "FEDORA-2009-0715",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
            },
            {
              "name": "SUSE-SR:2009:003",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
            },
            {
              "name": "33505",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33505"
            },
            {
              "name": "MDVSA-2009:030",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=479560",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
            },
            {
              "name": "[oss-security] 20090114 CVE Request -- amarok",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2009/01/14/2"
            },
            {
              "name": "34315",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34315"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=479946",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
            },
            {
              "name": "http://trapkit.de/advisories/TKADV2009-002.txt",
              "refsource": "MISC",
              "url": "http://trapkit.de/advisories/TKADV2009-002.txt"
            },
            {
              "name": "http://amarok.kde.org/en/releases/2.0.1.1",
              "refsource": "CONFIRM",
              "url": "http://amarok.kde.org/en/releases/2.0.1.1"
            },
            {
              "name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=908401",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
            },
            {
              "name": "34407",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34407"
            },
            {
              "name": "33640",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33640"
            },
            {
              "name": "4915",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4915"
            },
            {
              "name": "33210",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/33210"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=254896",
              "refsource": "CONFIRM",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
            },
            {
              "name": "1021558",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1021558"
            },
            {
              "name": "33819",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33819"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0136",
    "datePublished": "2009-01-16T18:00:00.000Z",
    "dateReserved": "2009-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-07T04:24:18.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3699 (GCVE-0-2008-3699)

    Vulnerability from cvelistv5 – Published: 2008-08-14 23:00 – Updated: 2024-08-07 09:45
    VLAI
    Summary
    The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://secunia.com/advisories/32357 third-party-advisoryx_refsource_SECUNIA
    http://websvn.kde.org/?view=rev&revision=846626 x_refsource_CONFIRM
    http://secunia.com/advisories/31418 third-party-advisoryx_refsource_SECUNIA
    http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
    http://www.ubuntu.com/usn/usn-657-1 vendor-advisoryx_refsource_UBUNTU
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765 x_refsource_MISC
    http://amarok.kde.org/en/releases/1/4/10 x_refsource_CONFIRM
    https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
    http://www.vupen.com/english/advisories/2008/2338 vdb-entryx_refsource_VUPEN
    http://secunia.com/advisories/31663 third-party-advisoryx_refsource_SECUNIA
    http://security.gentoo.org/glsa/glsa-200809-08.xml vendor-advisoryx_refsource_GENTOO
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://slackware.com/security/viewer.php?l=slackw… vendor-advisoryx_refsource_SLACKWARE
    http://www.securityfocus.com/bid/30662 vdb-entryx_refsource_BID
    https://www.redhat.com/archives/fedora-package-an… vendor-advisoryx_refsource_FEDORA
    http://secunia.com/advisories/31839 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2008-08-11 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:45:19.215Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "32357",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32357"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
          },
          {
            "name": "31418",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31418"
          },
          {
            "name": "MDVSA-2008:172",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
          },
          {
            "name": "USN-657-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-657-1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://amarok.kde.org/en/releases/1/4/10"
          },
          {
            "name": "FEDORA-2008-7739",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
          },
          {
            "name": "ADV-2008-2338",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2338"
          },
          {
            "name": "31663",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31663"
          },
          {
            "name": "GLSA-200809-08",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
          },
          {
            "name": "amarok-magnatunebrowser-symlink(44399)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
          },
          {
            "name": "SSA:2008-241-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
          },
          {
            "name": "30662",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30662"
          },
          {
            "name": "FEDORA-2008-7719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
          },
          {
            "name": "31839",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31839"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-08-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "32357",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32357"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
        },
        {
          "name": "31418",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31418"
        },
        {
          "name": "MDVSA-2008:172",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
        },
        {
          "name": "USN-657-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-657-1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://amarok.kde.org/en/releases/1/4/10"
        },
        {
          "name": "FEDORA-2008-7739",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
        },
        {
          "name": "ADV-2008-2338",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2338"
        },
        {
          "name": "31663",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31663"
        },
        {
          "name": "GLSA-200809-08",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
        },
        {
          "name": "amarok-magnatunebrowser-symlink(44399)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
        },
        {
          "name": "SSA:2008-241-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
        },
        {
          "name": "30662",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30662"
        },
        {
          "name": "FEDORA-2008-7719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
        },
        {
          "name": "31839",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31839"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3699",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "32357",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32357"
            },
            {
              "name": "http://websvn.kde.org/?view=rev\u0026revision=846626",
              "refsource": "CONFIRM",
              "url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
            },
            {
              "name": "31418",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31418"
            },
            {
              "name": "MDVSA-2008:172",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
            },
            {
              "name": "USN-657-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-657-1"
            },
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765",
              "refsource": "MISC",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
            },
            {
              "name": "http://amarok.kde.org/en/releases/1/4/10",
              "refsource": "CONFIRM",
              "url": "http://amarok.kde.org/en/releases/1/4/10"
            },
            {
              "name": "FEDORA-2008-7739",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
            },
            {
              "name": "ADV-2008-2338",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2338"
            },
            {
              "name": "31663",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31663"
            },
            {
              "name": "GLSA-200809-08",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
            },
            {
              "name": "amarok-magnatunebrowser-symlink(44399)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
            },
            {
              "name": "SSA:2008-241-01",
              "refsource": "SLACKWARE",
              "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
            },
            {
              "name": "30662",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30662"
            },
            {
              "name": "FEDORA-2008-7719",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
            },
            {
              "name": "31839",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31839"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3699",
    "datePublished": "2008-08-14T23:00:00.000Z",
    "dateReserved": "2008-08-14T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:45:19.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2006-6979 (GCVE-0-2006-6979)

    Vulnerability from cvelistv5 – Published: 2007-02-08 18:00 – Updated: 2024-08-07 20:50
    VLAI
    Summary
    The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://secunia.com/advisories/23984 third-party-advisoryx_refsource_SECUNIA
    http://www.vupen.com/english/advisories/2007/0613 vdb-entryx_refsource_VUPEN
    http://lists.suse.com/archive/suse-security-annou… vendor-advisoryx_refsource_SUSE
    http://bugs.gentoo.org/show_bug.cgi?id=166901 x_refsource_MISC
    http://secunia.com/advisories/24510 third-party-advisoryx_refsource_SECUNIA
    http://www.securityfocus.com/bid/22568 vdb-entryx_refsource_BID
    http://bugs.kde.org/show_bug.cgi?id=138499 x_refsource_MISC
    http://security.gentoo.org/glsa/glsa-200703-11.xml vendor-advisoryx_refsource_GENTOO
    http://secunia.com/advisories/24159 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2006-01-27 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T20:50:04.608Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "23984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23984"
          },
          {
            "name": "ADV-2007-0613",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/0613"
          },
          {
            "name": "SUSE-SR:2007:002",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
          },
          {
            "name": "24510",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/24510"
          },
          {
            "name": "22568",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/22568"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.kde.org/show_bug.cgi?id=138499"
          },
          {
            "name": "GLSA-200703-11",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
          },
          {
            "name": "24159",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/24159"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2007-02-16T10:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "23984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23984"
        },
        {
          "name": "ADV-2007-0613",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/0613"
        },
        {
          "name": "SUSE-SR:2007:002",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
        },
        {
          "name": "24510",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/24510"
        },
        {
          "name": "22568",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/22568"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.kde.org/show_bug.cgi?id=138499"
        },
        {
          "name": "GLSA-200703-11",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
        },
        {
          "name": "24159",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/24159"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-6979",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "23984",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23984"
            },
            {
              "name": "ADV-2007-0613",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/0613"
            },
            {
              "name": "SUSE-SR:2007:002",
              "refsource": "SUSE",
              "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=166901",
              "refsource": "MISC",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
            },
            {
              "name": "24510",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/24510"
            },
            {
              "name": "22568",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/22568"
            },
            {
              "name": "http://bugs.kde.org/show_bug.cgi?id=138499",
              "refsource": "MISC",
              "url": "http://bugs.kde.org/show_bug.cgi?id=138499"
            },
            {
              "name": "GLSA-200703-11",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
            },
            {
              "name": "24159",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/24159"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-6979",
    "datePublished": "2007-02-08T18:00:00.000Z",
    "dateReserved": "2007-02-08T00:00:00.000Z",
    "dateUpdated": "2024-08-07T20:50:04.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2005-2029 (GCVE-0-2005-2029)

    Vulnerability from cvelistv5 – Published: 2005-06-21 04:00 – Updated: 2024-09-17 04:04
    VLAI
    Summary
    amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://secunia.com/advisories/15736 third-party-advisoryx_refsource_SECUNIA
    http://sourceforge.net/project/shownotes.php?rele… x_refsource_CONFIRM
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T22:15:36.796Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "15736",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/15736"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2005-06-21T04:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "15736",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/15736"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-2029",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "15736",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/15736"
            },
            {
              "name": "http://sourceforge.net/project/shownotes.php?release_id=335719",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-2029",
    "datePublished": "2005-06-21T04:00:00.000Z",
    "dateReserved": "2005-06-21T00:00:00.000Z",
    "dateUpdated": "2024-09-17T04:04:49.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}