Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities by amarok
CVE-2009-0136 (GCVE-0-2009-0136)
Vulnerability from nvd – Published: 2009-01-16 18:00 – Updated: 2024-08-07 04:24
VLAI
EPSS
VEX
Summary
Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
26 references
Date Public
2009-01-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T04:24:18.392Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-1706",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34315"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/33210"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33819"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-01-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-11T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-1706",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34315"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/33210"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33819"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0136",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-1706",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908391",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908415",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=479560",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34315"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=479946",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"name": "http://trapkit.de/advisories/TKADV2009-002.txt",
"refsource": "MISC",
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"name": "http://amarok.kde.org/en/releases/2.0.1.1",
"refsource": "CONFIRM",
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908401",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/33210"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=254896",
"refsource": "CONFIRM",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33819"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-0136",
"datePublished": "2009-01-16T18:00:00.000Z",
"dateReserved": "2009-01-16T00:00:00.000Z",
"dateUpdated": "2024-08-07T04:24:18.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-0135 (GCVE-0-2009-0135)
Vulnerability from nvd – Published: 2009-01-16 18:00 – Updated: 2024-08-07 04:24
VLAI
EPSS
VEX
Summary
Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
26 references
Date Public
2009-01-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T04:24:18.248Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-1706",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34315"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/33210"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33819"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-01-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-11T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-1706",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34315"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/33210"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33819"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0135",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-1706",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908391",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908415",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=479560",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34315"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=479946",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"name": "http://trapkit.de/advisories/TKADV2009-002.txt",
"refsource": "MISC",
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"name": "http://amarok.kde.org/en/releases/2.0.1.1",
"refsource": "CONFIRM",
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908401",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/33210"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=254896",
"refsource": "CONFIRM",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33819"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-0135",
"datePublished": "2009-01-16T18:00:00.000Z",
"dateReserved": "2009-01-16T00:00:00.000Z",
"dateUpdated": "2024-08-07T04:24:18.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-3699 (GCVE-0-2008-3699)
Vulnerability from nvd – Published: 2008-08-14 23:00 – Updated: 2024-08-07 09:45
VLAI
EPSS
VEX
Summary
The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
16 references
Date Public
2008-08-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:45:19.215Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "32357",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32357"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
},
{
"name": "31418",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31418"
},
{
"name": "MDVSA-2008:172",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
},
{
"name": "USN-657-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/usn-657-1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://amarok.kde.org/en/releases/1/4/10"
},
{
"name": "FEDORA-2008-7739",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
},
{
"name": "ADV-2008-2338",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2338"
},
{
"name": "31663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31663"
},
{
"name": "GLSA-200809-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
},
{
"name": "amarok-magnatunebrowser-symlink(44399)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
},
{
"name": "SSA:2008-241-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE",
"x_transferred"
],
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
},
{
"name": "30662",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30662"
},
{
"name": "FEDORA-2008-7719",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
},
{
"name": "31839",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31839"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "32357",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32357"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
},
{
"name": "31418",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31418"
},
{
"name": "MDVSA-2008:172",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
},
{
"name": "USN-657-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/usn-657-1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://amarok.kde.org/en/releases/1/4/10"
},
{
"name": "FEDORA-2008-7739",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
},
{
"name": "ADV-2008-2338",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2338"
},
{
"name": "31663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31663"
},
{
"name": "GLSA-200809-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
},
{
"name": "amarok-magnatunebrowser-symlink(44399)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
},
{
"name": "SSA:2008-241-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE"
],
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
},
{
"name": "30662",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30662"
},
{
"name": "FEDORA-2008-7719",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
},
{
"name": "31839",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31839"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3699",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "32357",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32357"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=846626",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
},
{
"name": "31418",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31418"
},
{
"name": "MDVSA-2008:172",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
},
{
"name": "USN-657-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/usn-657-1"
},
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765",
"refsource": "MISC",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
},
{
"name": "http://amarok.kde.org/en/releases/1/4/10",
"refsource": "CONFIRM",
"url": "http://amarok.kde.org/en/releases/1/4/10"
},
{
"name": "FEDORA-2008-7739",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
},
{
"name": "ADV-2008-2338",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2338"
},
{
"name": "31663",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31663"
},
{
"name": "GLSA-200809-08",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
},
{
"name": "amarok-magnatunebrowser-symlink(44399)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
},
{
"name": "SSA:2008-241-01",
"refsource": "SLACKWARE",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
},
{
"name": "30662",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/30662"
},
{
"name": "FEDORA-2008-7719",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
},
{
"name": "31839",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31839"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3699",
"datePublished": "2008-08-14T23:00:00.000Z",
"dateReserved": "2008-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-07T09:45:19.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-6979 (GCVE-0-2006-6979)
Vulnerability from nvd – Published: 2007-02-08 18:00 – Updated: 2024-08-07 20:50
VLAI
EPSS
VEX
Summary
The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/23984 | third-party-advisoryx_refsource_SECUNIA |
| http://www.vupen.com/english/advisories/2007/0613 | vdb-entryx_refsource_VUPEN |
| http://lists.suse.com/archive/suse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://bugs.gentoo.org/show_bug.cgi?id=166901 | x_refsource_MISC |
| http://secunia.com/advisories/24510 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/22568 | vdb-entryx_refsource_BID |
| http://bugs.kde.org/show_bug.cgi?id=138499 | x_refsource_MISC |
| http://security.gentoo.org/glsa/glsa-200703-11.xml | vendor-advisoryx_refsource_GENTOO |
| http://secunia.com/advisories/24159 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2006-01-27 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:50:04.608Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "23984",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23984"
},
{
"name": "ADV-2007-0613",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0613"
},
{
"name": "SUSE-SR:2007:002",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
},
{
"name": "24510",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24510"
},
{
"name": "22568",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22568"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.kde.org/show_bug.cgi?id=138499"
},
{
"name": "GLSA-200703-11",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
},
{
"name": "24159",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24159"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-02-16T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "23984",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23984"
},
{
"name": "ADV-2007-0613",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0613"
},
{
"name": "SUSE-SR:2007:002",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
},
{
"name": "24510",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24510"
},
{
"name": "22568",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22568"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.kde.org/show_bug.cgi?id=138499"
},
{
"name": "GLSA-200703-11",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
},
{
"name": "24159",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24159"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6979",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "23984",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23984"
},
{
"name": "ADV-2007-0613",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0613"
},
{
"name": "SUSE-SR:2007:002",
"refsource": "SUSE",
"url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=166901",
"refsource": "MISC",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
},
{
"name": "24510",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24510"
},
{
"name": "22568",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22568"
},
{
"name": "http://bugs.kde.org/show_bug.cgi?id=138499",
"refsource": "MISC",
"url": "http://bugs.kde.org/show_bug.cgi?id=138499"
},
{
"name": "GLSA-200703-11",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
},
{
"name": "24159",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24159"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6979",
"datePublished": "2007-02-08T18:00:00.000Z",
"dateReserved": "2007-02-08T00:00:00.000Z",
"dateUpdated": "2024-08-07T20:50:04.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-2029 (GCVE-0-2005-2029)
Vulnerability from nvd – Published: 2005-06-21 04:00 – Updated: 2024-09-17 04:04
VLAI
EPSS
VEX
Summary
amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/15736 | third-party-advisoryx_refsource_SECUNIA |
| http://sourceforge.net/project/shownotes.php?rele… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:15:36.796Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15736",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15736"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-06-21T04:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15736",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15736"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2029",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15736",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15736"
},
{
"name": "http://sourceforge.net/project/shownotes.php?release_id=335719",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2029",
"datePublished": "2005-06-21T04:00:00.000Z",
"dateReserved": "2005-06-21T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:04:49.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-0136 (GCVE-0-2009-0136)
Vulnerability from cvelistv5 – Published: 2009-01-16 18:00 – Updated: 2024-08-07 04:24
VLAI
EPSS
VEX
Summary
Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
26 references
Date Public
2009-01-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T04:24:18.392Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-1706",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34315"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/33210"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33819"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-01-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-11T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-1706",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34315"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/33210"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33819"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0136",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-1706",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908391",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908415",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=479560",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34315"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=479946",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"name": "http://trapkit.de/advisories/TKADV2009-002.txt",
"refsource": "MISC",
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"name": "http://amarok.kde.org/en/releases/2.0.1.1",
"refsource": "CONFIRM",
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908401",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/33210"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=254896",
"refsource": "CONFIRM",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33819"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-0136",
"datePublished": "2009-01-16T18:00:00.000Z",
"dateReserved": "2009-01-16T00:00:00.000Z",
"dateUpdated": "2024-08-07T04:24:18.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-0135 (GCVE-0-2009-0135)
Vulnerability from cvelistv5 – Published: 2009-01-16 18:00 – Updated: 2024-08-07 04:24
VLAI
EPSS
VEX
Summary
Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
26 references
Date Public
2009-01-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T04:24:18.248Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-1706",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34315"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/33210"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33819"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-01-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-11T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-1706",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34315"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/33210"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33819"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0135",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-1706",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1706"
},
{
"name": "USN-739-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-739-1"
},
{
"name": "ADV-2009-0100",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0100"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908391",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908391"
},
{
"name": "33522",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33522"
},
{
"name": "GLSA-200903-34",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200903-34.xml"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908415",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908415"
},
{
"name": "FEDORA-2009-0715",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "33505",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33505"
},
{
"name": "MDVSA-2009:030",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:030"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=479560",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479560"
},
{
"name": "[oss-security] 20090114 CVE Request -- amarok",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2009/01/14/2"
},
{
"name": "34315",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34315"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=479946",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=479946"
},
{
"name": "http://trapkit.de/advisories/TKADV2009-002.txt",
"refsource": "MISC",
"url": "http://trapkit.de/advisories/TKADV2009-002.txt"
},
{
"name": "http://amarok.kde.org/en/releases/2.0.1.1",
"refsource": "CONFIRM",
"url": "http://amarok.kde.org/en/releases/2.0.1.1"
},
{
"name": "20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/499984/100/0/threaded"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=908401",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=908401"
},
{
"name": "34407",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34407"
},
{
"name": "33640",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33640"
},
{
"name": "4915",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/4915"
},
{
"name": "33210",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/33210"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=254896",
"refsource": "CONFIRM",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=254896"
},
{
"name": "1021558",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1021558"
},
{
"name": "33819",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33819"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-0135",
"datePublished": "2009-01-16T18:00:00.000Z",
"dateReserved": "2009-01-16T00:00:00.000Z",
"dateUpdated": "2024-08-07T04:24:18.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-3699 (GCVE-0-2008-3699)
Vulnerability from cvelistv5 – Published: 2008-08-14 23:00 – Updated: 2024-08-07 09:45
VLAI
EPSS
VEX
Summary
The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
16 references
Date Public
2008-08-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:45:19.215Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "32357",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32357"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
},
{
"name": "31418",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31418"
},
{
"name": "MDVSA-2008:172",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
},
{
"name": "USN-657-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/usn-657-1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://amarok.kde.org/en/releases/1/4/10"
},
{
"name": "FEDORA-2008-7739",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
},
{
"name": "ADV-2008-2338",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2338"
},
{
"name": "31663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31663"
},
{
"name": "GLSA-200809-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
},
{
"name": "amarok-magnatunebrowser-symlink(44399)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
},
{
"name": "SSA:2008-241-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE",
"x_transferred"
],
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
},
{
"name": "30662",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30662"
},
{
"name": "FEDORA-2008-7719",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
},
{
"name": "31839",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31839"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "32357",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32357"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
},
{
"name": "31418",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31418"
},
{
"name": "MDVSA-2008:172",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
},
{
"name": "USN-657-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/usn-657-1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://amarok.kde.org/en/releases/1/4/10"
},
{
"name": "FEDORA-2008-7739",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
},
{
"name": "ADV-2008-2338",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2338"
},
{
"name": "31663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31663"
},
{
"name": "GLSA-200809-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
},
{
"name": "amarok-magnatunebrowser-symlink(44399)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
},
{
"name": "SSA:2008-241-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE"
],
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
},
{
"name": "30662",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30662"
},
{
"name": "FEDORA-2008-7719",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
},
{
"name": "31839",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31839"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3699",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "32357",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32357"
},
{
"name": "http://websvn.kde.org/?view=rev\u0026revision=846626",
"refsource": "CONFIRM",
"url": "http://websvn.kde.org/?view=rev\u0026revision=846626"
},
{
"name": "31418",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31418"
},
{
"name": "MDVSA-2008:172",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"
},
{
"name": "USN-657-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/usn-657-1"
},
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765",
"refsource": "MISC",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"
},
{
"name": "http://amarok.kde.org/en/releases/1/4/10",
"refsource": "CONFIRM",
"url": "http://amarok.kde.org/en/releases/1/4/10"
},
{
"name": "FEDORA-2008-7739",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html"
},
{
"name": "ADV-2008-2338",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2338"
},
{
"name": "31663",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31663"
},
{
"name": "GLSA-200809-08",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200809-08.xml"
},
{
"name": "amarok-magnatunebrowser-symlink(44399)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44399"
},
{
"name": "SSA:2008-241-01",
"refsource": "SLACKWARE",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.455790"
},
{
"name": "30662",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/30662"
},
{
"name": "FEDORA-2008-7719",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html"
},
{
"name": "31839",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31839"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3699",
"datePublished": "2008-08-14T23:00:00.000Z",
"dateReserved": "2008-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-07T09:45:19.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-6979 (GCVE-0-2006-6979)
Vulnerability from cvelistv5 – Published: 2007-02-08 18:00 – Updated: 2024-08-07 20:50
VLAI
EPSS
VEX
Summary
The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/23984 | third-party-advisoryx_refsource_SECUNIA |
| http://www.vupen.com/english/advisories/2007/0613 | vdb-entryx_refsource_VUPEN |
| http://lists.suse.com/archive/suse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://bugs.gentoo.org/show_bug.cgi?id=166901 | x_refsource_MISC |
| http://secunia.com/advisories/24510 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/22568 | vdb-entryx_refsource_BID |
| http://bugs.kde.org/show_bug.cgi?id=138499 | x_refsource_MISC |
| http://security.gentoo.org/glsa/glsa-200703-11.xml | vendor-advisoryx_refsource_GENTOO |
| http://secunia.com/advisories/24159 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2006-01-27 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:50:04.608Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "23984",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23984"
},
{
"name": "ADV-2007-0613",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0613"
},
{
"name": "SUSE-SR:2007:002",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
},
{
"name": "24510",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24510"
},
{
"name": "22568",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22568"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.kde.org/show_bug.cgi?id=138499"
},
{
"name": "GLSA-200703-11",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
},
{
"name": "24159",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24159"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-02-16T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "23984",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23984"
},
{
"name": "ADV-2007-0613",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0613"
},
{
"name": "SUSE-SR:2007:002",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
},
{
"name": "24510",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24510"
},
{
"name": "22568",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22568"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.kde.org/show_bug.cgi?id=138499"
},
{
"name": "GLSA-200703-11",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
},
{
"name": "24159",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24159"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6979",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "23984",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23984"
},
{
"name": "ADV-2007-0613",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0613"
},
{
"name": "SUSE-SR:2007:002",
"refsource": "SUSE",
"url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=166901",
"refsource": "MISC",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=166901"
},
{
"name": "24510",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24510"
},
{
"name": "22568",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22568"
},
{
"name": "http://bugs.kde.org/show_bug.cgi?id=138499",
"refsource": "MISC",
"url": "http://bugs.kde.org/show_bug.cgi?id=138499"
},
{
"name": "GLSA-200703-11",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200703-11.xml"
},
{
"name": "24159",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24159"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6979",
"datePublished": "2007-02-08T18:00:00.000Z",
"dateReserved": "2007-02-08T00:00:00.000Z",
"dateUpdated": "2024-08-07T20:50:04.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-2029 (GCVE-0-2005-2029)
Vulnerability from cvelistv5 – Published: 2005-06-21 04:00 – Updated: 2024-09-17 04:04
VLAI
EPSS
VEX
Summary
amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/15736 | third-party-advisoryx_refsource_SECUNIA |
| http://sourceforge.net/project/shownotes.php?rele… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:15:36.796Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15736",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/15736"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-06-21T04:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15736",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/15736"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2029",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15736",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/15736"
},
{
"name": "http://sourceforge.net/project/shownotes.php?release_id=335719",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/project/shownotes.php?release_id=335719"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2029",
"datePublished": "2005-06-21T04:00:00.000Z",
"dateReserved": "2005-06-21T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:04:49.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}