Bug 1193986 (CVE-2021-40827)

Summary: VUL-1: CVE-2021-40827: clementine: clementine through 1.3.1 is vulnerable to a Read Access Violation
Product: [openSUSE] openSUSE Distribution Reporter: Gabriele Sonnu <gabriele.sonnu>
Component: SecurityAssignee: Security Team bot <security-team>
Status: RESOLVED INVALID QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P5 - None    
Version: Leap 15.3   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/317522/
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Gabriele Sonnu 2021-12-22 09:16:43 UTC
Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is
vulnerable to a Read Access Violation on Block Data Move, affecting the MP3 file
parsing functionality at memcpy+0x265. The vulnerability is triggered when the
user opens a crafted MP3 file or loads a remote stream URL that is mishandled by
Clementine. Attackers could exploit this issue to cause a crash (DoS) of the
clementine.exe process or achieve arbitrary code execution in the context of the
current logged-in Windows user.

Comment 1 Gabriele Sonnu 2021-12-22 09:17:09 UTC
Only affects Windows. Closing.