CVE-2009-3995

Winamp < 5.57 - Remote Code Execution via Crafted Impulse Tracker File

Title source: llm
STIX 2.1

Description

Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file. NOTE: some of these details are obtained from third party information.

References (14)

Core 14
Core References
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2009-53/
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2009-52/
Various Sources x_refsource_confirm
http://forums.winamp.com/showthread.php?threadid=315355
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1107
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/37374
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1957
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37495
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/3575
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/508527/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/40799
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/508526/100/0/threaded
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2009-55/

Scores

EPSS 0.0672
EPSS Percentile 93.2%

Details

CWE
CWE-119
Status published
Products (42)
nullsoft/winamp 0.20a
nullsoft/winamp 0.92
nullsoft/winamp 1.006
nullsoft/winamp 1.90
nullsoft/winamp 2.0
nullsoft/winamp 2.4
nullsoft/winamp 2.5e
nullsoft/winamp 2.6
nullsoft/winamp 2.6x
nullsoft/winamp 2.7x
... and 32 more
Published Dec 18, 2009
Tracked Since Feb 18, 2026