CVE-2009-3996

Winamp < 5.57 - Remote Code Execution via Ultratracker File

Title source: llm
STIX 2.1

Description

Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via an Ultratracker file.

References (10)

Core 10
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1107
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/3575
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:151
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/37374
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37495
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/508528/100/0/threaded
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2009-56/
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2009-55/

Scores

EPSS 0.0648
EPSS Percentile 93.0%

Details

CWE
CWE-119
Status published
Products (42)
nullsoft/winamp 0.20a
nullsoft/winamp 0.92
nullsoft/winamp 1.006
nullsoft/winamp 1.90
nullsoft/winamp 2.0
nullsoft/winamp 2.4
nullsoft/winamp 2.5e
nullsoft/winamp 2.6
nullsoft/winamp 2.6x
nullsoft/winamp 2.7x
... and 32 more
Published Dec 18, 2009
Tracked Since Feb 18, 2026