Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
NameMDVSA-2009:093First vendor Publication2009-04-22
VendorMandrivaLast vendor Modification2009-04-22
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score10Attack RangeNetwork
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability has been found and corrected in mpg123:

Integer signedness error in the store_id3_text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via an ID3 tag with a negative encoding value. NOTE: some of these details are obtained from third party information (CVE-2009-1301).

The updated packages have been patched to correct this issue.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2009:093

CWE : Common Weakness Enumeration

idName
CWE-189Numeric Errors (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application14

OpenVAS Exploits

DateDescription
2009-12-14Name : Mandriva Security Advisory MDVSA-2009:093-1 (mpg123)
File : nvt/mdksa_2009_093_1.nasl
2009-06-05Name : Ubuntu USN-763-1 (xine-lib)
File : nvt/ubuntu_763_1.nasl
2009-04-28Name : Mandrake Security Advisory MDVSA-2009:093 (mpg123)
File : nvt/mdksa_2009_093.nasl
2009-04-28Name : mpg123 Player Denial of Service Vulnerability (Linux)
File : nvt/secpod_mpg123_player_dos_vuln_lin.nasl
2009-04-20Name : Gentoo Security Advisory GLSA 200904-15 (mpg123)
File : nvt/glsa_200904_15.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
56311mpg123 ID3v2 Functionality store_id3_text() Function ID3 Tag Handling Arbitra...

Nessus® Vulnerability Scanner

DateDescription
2009-04-23Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2009-093.nasl - Type : ACT_GATHER_INFO
2009-04-17Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200904-15.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 11:40:11
  • Multiple Updates