PT-2021-7562 · Unknown+1 · Clementine Music Player+1

Voidsec · Published 2021-09-09 · Updated 2022-07-12 · CVE-2021-40826

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Clementine Music Player versions prior to 1.3.2

Description The issue is related to a User Mode Write Access Violation in the MP3 file parsing functionality. It is triggered when a user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine. This could allow attackers to cause a crash of the clementine.exe process or achieve arbitrary code execution in the context of the current logged-in Windows user. The vulnerability is also associated with a pointer dereference error when loading MP3 files, which can lead to a denial of service or arbitrary code execution.

Recommendations For Clementine Music Player versions prior to 1.3.2, update to a version later than 1.3.1 to resolve the issue. As a temporary workaround, consider avoiding the use of crafted MP3 files or remote stream URLs that could trigger the vulnerability. Restrict access to the MP3 file parsing functionality to minimize the risk of exploitation.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2023-00083

CVE-2021-40826

Affected Products

Clementine Music Player

Debian

References · 13

• 🔥 https://voidsec.com/advisories/cve-2021-40826 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-40826 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-40826 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40826 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00083 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-40826 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-40826 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-40826 · Security Note
• https://ubuntu.com/security/CVE-2021-40826 · Vendor Advisory
• https://github.com/clementine-player/Clementine/commit/55edcf5321051e44281f067a7e3ee44871982c12 · Note
• https://github.com/clementine-player/Clementine/issues/7134 · Note
• https://github.com/clementine-player/Clementine/issues/7086 · Note
• https://bugs.gentoo.org/829307 · Note