CVE-2009-0490

EPSS 16.6%

Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .gro file containing a long string.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencewww.exploit-db.com/exploits/7634unverified exploitdbwww.exploit-db.com/exploits/9501unverified exploitdbwww.exploit-db.com/exploits/10322unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://bugs.gentoo.org/show_bug.cgi?id=253493 http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://n2.nabble.com/Audacity-%22String_parse::get_nonspace_quoted%28%29%22-Buffer-Overflow-td2139537.html http://osvdb.org/51070 http://secunia.com/advisories/33356 https://www.exploit-db.com/exploits/7634 http://www.securityfocus.com/bid/33090 http://www.vupen.com/english/advisories/2009/0008