CVE-2009-0135: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio .aa file with a large 1 nlen or 2 vlen Tag value, each of which triggers a heap-based buffer...

CVE-2009-0136: Undefined Security Weakness

Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service application crash or execute arbitrary code via an Audible Audio .aa file with a crafted 1 nlen or 2 vlen Tag...