VDB
CVE-2009-1438
CVE-2009-1438
PUBLISHED
CVSS 7.5 HIGH
Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.
EPSS 4.67% · 91.6th percentile
Risk Scores
CVSS 2.0
7.5
EPSS Score
4.67%
91.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| konstanty_bialkowski | libmodplug | 0, 0.8, 0.8.4 |
Timeline
- Apr 27, 2009 VulnCheck KEV Exploitation
- Apr 27, 2009 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 4, 2023 EPSS Score
- Jul 19, 2023 EPSS Score
References
- 53801 vdb
- http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&%3Br2=1.2 url
- 36183 third-party-advisory
- 36158 third-party-advisory
- 30801 vdb
- http://sourceforge.net/project/shownotes.php?release_id=677065&group_id=1275 url
- 35685 third-party-advisory
- 34930 third-party-advisory
- SUSE-SR:2009:012 vendor-advisory
- [oss-security] 20090421 CVE Request -- libmodplug mailing-list
- USN-771-1 vendor-advisory
- 34797 third-party-advisory
- 35736 third-party-advisory
- DSA-1850 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=496834 url
- DSA-1851 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=266913 url
- MDVSA-2009:128 vendor-advisory
- libmodplug-csoundfilereadmed-bo(50388) vdb
- 35026 third-party-advisory
…and 6 more