GHSA-f836-7jqw-3684

Libextractor multiple heap-based buffer overflows

Source: GitHub Advisory Database (reviewed) Moderate CVE-2006-2458

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	extractor	0.5	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2006-2458 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/26531 web
https://exchange.xforce.ibmcloud.com/vulnerabilities/26532 web
https://github.com/pypa/advisory-database/tree/main/vulns/extractor/PYSEC-2006-4.yaml web
http://gnunet.org/libextractor web
http://www.debian.org/security/2006/dsa-1081 web
http://www.gentoo.org/security/en/glsa/glsa-200605-14.xml web