VDB
CVE-2009-1438
CVE-2009-1438
PUBLISHED
CVSS 7.5 HIGH
Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.
EPSS 2.55% · 85.8th percentile
Risk Scores
CVSS 2.0
7.5
EPSS Score
2.55%
85.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| konstanty_bialkowski | libmodplug | 0, 0.8, 0.8.4 |
Timeline
- Apr 27, 2009 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
References
- 53801 vdb
- USN-771-1 vendor-advisory
- http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/load_med.cpp?r1=1.1&%3Br2=1.2 url
- 34797 third-party-advisory
- 35736 third-party-advisory
- 36183 third-party-advisory
- DSA-1850 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=496834 url
- DSA-1851 vendor-advisory
- 36158 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=266913 url
- 30801 vdb
- MDVSA-2009:128 vendor-advisory
- libmodplug-csoundfilereadmed-bo(50388) vdb
- 35026 third-party-advisory
- http://sourceforge.net/project/shownotes.php?release_id=677065&group_id=1275 url
- GLSA-200907-07 vendor-advisory
- 35685 third-party-advisory
- FEDORA-2009-4068 vendor-advisory
- FEDORA-2009-4064 vendor-advisory
…and 6 more