PT-2012-5164 · Nullsoft · Winamp

Published 2012-07-22 · Updated 2017-09-19 · CVE-2012-4045

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Winamp versions prior to 5.63 build 3235

Description The issue is related to multiple heap-based buffer overflows in the bmp.w5s component. This can be exploited by remote attackers to execute arbitrary code through various means, including the strf chunk in BI RGB, UYVY video data in an AVI file, or decompressed TechSmith Screen Capture Codec (TSCC) data in an AVI file.

Recommendations For versions prior to 5.63 build 3235, update to version 5.63 build 3235 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the bmp.w5s component or restricting access to AVI files until the update is applied.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-4045

Affected Products

Winamp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2012-4045 · Security Note
• http://secunia.com/advisories/46624 · Vendor Advisory
• http://forums.winamp.com/showthread.php?t=345684 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4045 · Note
• http://securityfocus.com/bid/54131 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15335 · Note