Multiple heap-based buffer overflows in Media Commands 1.0 allow remote attackers to execute arbitrary code or cause a denial of service (a…

Exploit prediction (EPSS)

8.75% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

Exploits and detections

• EDB-8137 Media Commands - '.m3u' Local Overwrite (SEH) · local · 2009-03-02
• EDB-8135 Media Commands - '.m3u' / '.m3l' / '.TXT' / '.LRC' Local Heap Overflow (PoC) · dos · 2009-03-02

CVSS scores

Classification

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

• securityfocus.com /bid/33958 · vdb-entry, x_refsource_BID, x_transferred
• securityfocus.com /data/vulnerabilities/exploits/33958-2.py · x_refsource_MISC, x_transferred
• vupen.com /english/advisories/2009/0583 · vdb-entry, x_refsource_VUPEN, x_transferred
• osvdb.org /52346 · vdb-entry, x_refsource_OSVDB, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/49035 · vdb-entry, x_refsource_XF, x_transferred
• securityfocus.com /data/vulnerabilities/exploits/33958.rb · x_refsource_MISC, x_transferred
• securityfocus.com /data/vulnerabilities/exploits/33958.py · x_refsource_MISC, x_transferred
• secunia.com /advisories/34122 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• exploit-db.com /exploits/8135 · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

• CVE List: CVE-2009-0885
• NVD: CVE-2009-0885

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.