« Volver al listado

CVE-2009-1791

Estado: ModificadaAlta (9.3)—

Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Mega-nerd — LibsndfileNullsoft — Winamp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-1791",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-05-26T17:30:02.063",
  "references": [
    {
      "url": "http://secunia.com/advisories/35076",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35247",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35443",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200905-09.xml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1814",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:132",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mega-nerd.com/libsndfile/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/34978",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/1324",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50541",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35076",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35247",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35443",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200905-09.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1814",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:132",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mega-nerd.com/libsndfile/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/34978",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/1324",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50541",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer basado en montículo en aiff_read_header en libsndfile desde v1.0.15 hasta v1.0.19, como se utiliza en Winamp v5.552 y posiblemente otros programas multimedia, permite a atacantes remotos producir una denegación (caída de aplicación) y posiblemente la ejecución de código de modo arbitrario a través de un fichero AIFF con un valor de cabecera no valido."
    }
  ],
  "lastModified": "2026-06-16T23:08:04.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mega-nerd:libsndfile:1.0.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "570D85F0-F757-488A-A059-54BF0810F1E0"
            },
            {
              "criteria": "cpe:2.3:a:mega-nerd:libsndfile:1.0.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E28BC682-E6B1-4A63-9734-FDB6019B9AE0"
            },
            {
              "criteria": "cpe:2.3:a:mega-nerd:libsndfile:1.0.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8823A84B-4694-4838-A877-AE66400B26BD"
            },
            {
              "criteria": "cpe:2.3:a:mega-nerd:libsndfile:1.0.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4C2B0D1-AE8A-4978-85B0-C5E0ABE89E79"
            },
            {
              "criteria": "cpe:2.3:a:mega-nerd:libsndfile:1.0.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "759BBF60-8964-4590-A5EB-F21EB4049E39"
            },
            {
              "criteria": "cpe:2.3:a:nullsoft:winamp:5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E02CCF2-2335-4F08-8061-6CFD7C8B265A"
            },
            {
              "criteria": "cpe:2.3:a:nullsoft:winamp:5.51:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FEE5A4C-770A-458B-AC1A-8F1F99A0951A"
            },
            {
              "criteria": "cpe:2.3:a:nullsoft:winamp:5.52:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B58E9493-556E-4085-B337-AE211A28DA6C"
            },
            {
              "criteria": "cpe:2.3:a:nullsoft:winamp:5.54:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C6E95D5-D855-4CD4-B44B-66FF029EC823"
            },
            {
              "criteria": "cpe:2.3:a:nullsoft:winamp:5.55:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "218E9850-70F5-4579-9549-47DD16ECD2B3"
            },
            {
              "criteria": "cpe:2.3:a:nullsoft:winamp:5.541:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "951898A7-A060-4853-8C4E-99927794C0FC"
            },
            {
              "criteria": "cpe:2.3:a:nullsoft:winamp:5.552:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DA20F35-AC57-4B5B-9EF1-8A4393BD1B33"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}