NVD Vulnerability Detail

CVE-2009-0186

Summary	Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
Publication Date	March 5, 2009, 11:30 a.m.
Registration Date	Jan. 29, 2021, 1:13 p.m.
Last Update	Oct. 12, 2018, 6 a.m.

Affected software configurations

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html	SUSE
2	http://secunia.com/advisories/33980	SECUNIA	Vendor Advisory
3	http://secunia.com/advisories/33981	SECUNIA	Vendor Advisory
4	http://secunia.com/advisories/34316	SECUNIA
5	http://secunia.com/advisories/34526	SECUNIA
6	http://secunia.com/advisories/34642	SECUNIA
7	http://secunia.com/advisories/34791	SECUNIA
8	http://secunia.com/secunia_research/2009-7/	MISC	Vendor Advisory
9	http://secunia.com/secunia_research/2009-8/	MISC	Vendor Advisory
10	http://security.gentoo.org/glsa/glsa-200904-16.xml	GENTOO
11	http://www.debian.org/security/2009/dsa-1742	DEBIAN
12	http://www.mega-nerd.com/libsndfile/NEWS	CONFIRM
13	http://www.securityfocus.com/archive/1/501399/100/0/threaded	BUGTRAQ
14	http://www.securityfocus.com/archive/1/501413/100/0/threaded	BUGTRAQ
15	http://www.securityfocus.com/bid/33963	BID
16	http://www.securitytracker.com/id?1021784	SECTRACK
17	http://www.ubuntu.com/usn/USN-749-1	UBUNTU
18	http://www.vupen.com/english/advisories/2009/0584	VUPEN	Vendor Advisory
19	http://www.vupen.com/english/advisories/2009/0585	VUPEN	Vendor Advisory
20	https://exchange.xforce.ibmcloud.com/vulnerabilities/49038	XF

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-189	数値処理の問題	https://cwe.mitre.org/data/definitions/189.html

JVN Vulnerability Information

Winamp などで利用される libsndfile における整数オーバーフローの脆弱性

Title	Winamp などで利用される libsndfile における整数オーバーフローの脆弱性
Summary	Winamp などで利用される libsndfile には、整数オーバーフローの脆弱性が存在します。
Possible impacts	攻撃者により、巧妙に細工された CAF オーディオファイルの記述を介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 5, 2009, midnight
Registration Date	May 10, 2011, 10:47 a.m.
Last Update	May 10, 2011, 10:47 a.m.

Affected System

オラクル

Oracle Solaris 11 Express

Nullsoft

Winamp 5.541

Winamp 5.55

Erik de Castro Lopo

libsndfile 1.0.18

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-0186	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0186
National Vulnerability Database (NVD)
2	CVE-2009-0186	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0186

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-189	https://jvndb.jvn.jp/ja/cwe/CWE-189.html

ベンダー情報

No	Name	URL
libsndfile
1	NEWS	http://www.mega-nerd.com/libsndfile/NEWS
SECURITY BLOG
2	Multiple Vulnerabilities in libsndfile	http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_libsndfile
Winamp
3	ダウンロードページ	http://www.winamp.com/media-player/japanese

その他

No	Name	URL
ISS X-Force Database
1	49038	http://xforce.iss.net/xforce/xfdb/49038
Secunia Advisory
2	SA33980	http://secunia.com/advisories/33980
3	SA33981	http://secunia.com/advisories/33981
SecurityFocus
4	33963	http://www.securityfocus.com/bid/33963
SecurityTracker
5	1021784	http://www.securitytracker.com/id?1021784

Change Log

No	Changed Details	Date of change
0	[2011年05月10日] 掲載	Feb. 17, 2018, 10:37 a.m.