CVE-2009-1438

Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products…

published April 27, 2009

CVSS
—
EPSS
5%
Percentile
91.7
In the wild
Unconfirmed
What it is

Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04667 · 91.7th percentile
Published
2009-04-27T17:43Z
EPSS history
Timeline
  • 27 APR 17:43Z
    Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products…
    cvelistv5