CVE-2009-0136

Multiple array index errors in the Audible::Tag::readTag function in
metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote
attackers to cause a denial of service (application crash) or execute
arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or
(2) vlen Tag value, each of which can lead to an invalid pointer
dereference, or the writing of a 0x00 byte to an arbitrary memory location,
after an allocation failure.

Bugs

• <https://bugs.launchpad.net/ubuntu/+source/amarok/+bug/318555&gt;
• <http://bugs.gentoo.org/show_bug.cgi?id=254896&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=479560&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=479946&gt;