CVE-2007-6731 Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which bypasses a check in (1) test_oxm and (2) decrunch_oxm funct...
HighCVSS 10.0
EPSS 14.1%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which bypasses a check in (1) test_oxm and (2) decrunch_oxm functions in misc/oxm.c, leading to a buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| claudio matsuoka extended module player | <= 2.5.1 | No fix listed |
| claudio matsuoka extended module player | = 2.2.0 | No fix listed |
| claudio matsuoka extended module player | = 2.2.1 | No fix listed |
| claudio matsuoka extended module player | = 2.3.0 | No fix listed |
| claudio matsuoka extended module player | = 2.3.1 | No fix listed |
| claudio matsuoka extended module player | = 2.3.2 | No fix listed |
| claudio matsuoka extended module player | = 2.4.0 | No fix listed |
| claudio matsuoka extended module player | = 2.4.1 | No fix listed |
| claudio matsuoka extended module player | = 2.5.0 | No fix listed |
| debian/xmp(Debian:12) | < 2.6.1-1 | 2.6.1-1 |
| debian/xmp(Debian:13) | < 2.6.1-1 | 2.6.1-1 |
| debian/xmp(Debian:14) | < 2.6.1-1 | 2.6.1-1 |
References
- Debian Security Tracker CVE-2007-6731 vendor-advisory
- bugs.debian.org issue-tracking
- aluigi.altervista.org exploit
- 27047 exploit vdb-entry
- ADV-2008-0009 vdb-entry vendor-advisory