Bug 1193986 (CVE-2021-40827)

Summary:	VUL-1: CVE-2021-40827: clementine: clementine through 1.3.1 is vulnerable to a Read Access Violation
Product:	[openSUSE] openSUSE Distribution	Reporter:	Gabriele Sonnu <gabriele.sonnu>
Component:	Security	Assignee:	Security Team bot <security-team>
Status:	RESOLVED INVALID	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P5 - None
Version:	Leap 15.3
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/317522/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Gabriele Sonnu 2021-12-22 09:16:43 UTC

Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is
vulnerable to a Read Access Violation on Block Data Move, affecting the MP3 file
parsing functionality at memcpy+0x265. The vulnerability is triggered when the
user opens a crafted MP3 file or loads a remote stream URL that is mishandled by
Clementine. Attackers could exploit this issue to cause a crash (DoS) of the
clementine.exe process or achieve arbitrary code execution in the context of the
current logged-in Windows user.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-40827
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40827
https://voidsec.com/advisories/cve-2021-40827/

Comment 1 Gabriele Sonnu 2021-12-22 09:17:09 UTC

Only affects Windows. Closing.