CVE-2008-3567 Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541 allows remote attackers to conduct cross-site scripting (XSS) attacks via an MP3 file with JavaScript...
MediumCVSS 4.3
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541 allows remote attackers to conduct cross-site scripting (XSS) attacks via an MP3 file with JavaScript in id3 tags.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nullsoft winamp | <= 5.54 | No fix listed |
| nullsoft winamp | = 2.0 | No fix listed |
| nullsoft winamp | = 2.4 | No fix listed |
| nullsoft winamp | = 2.5e | No fix listed |
| nullsoft winamp | = 2.6x | No fix listed |
| nullsoft winamp | = 2.7x | No fix listed |
| nullsoft winamp | = 2.10 | No fix listed |
| nullsoft winamp | = 2.24 | No fix listed |
| nullsoft winamp | = 2.50 | No fix listed |
| nullsoft winamp | = 2.60 | No fix listed |
| nullsoft winamp | = 2.61 | No fix listed |
| nullsoft winamp | = 2.62 | No fix listed |
| nullsoft winamp | = 2.64 | No fix listed |
| nullsoft winamp | = 2.65 | No fix listed |
| nullsoft winamp | = 2.70 | No fix listed |
| nullsoft winamp | = 2.71 | No fix listed |
| nullsoft winamp | = 2.72 | No fix listed |
| nullsoft winamp | = 2.73 | No fix listed |
| nullsoft winamp | = 2.74 | No fix listed |
| nullsoft winamp | = 2.75 | No fix listed |
| nullsoft winamp | = 2.76 | No fix listed |
| nullsoft winamp | = 2.77 | No fix listed |
| nullsoft winamp | = 2.78 | No fix listed |
| nullsoft winamp | = 2.79 | No fix listed |
| nullsoft winamp | = 2.80 | No fix listed |
Show 47 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nullsoft winamp | = 2.81 | No fix listed |
| nullsoft winamp | = 2.90 | No fix listed |
| nullsoft winamp | = 2.91 | No fix listed |
| nullsoft winamp | = 2.95 | No fix listed |
| nullsoft winamp | = 3.0 | No fix listed |
| nullsoft winamp | = 3.1 | No fix listed |
| nullsoft winamp | = 5.0 | No fix listed |
| nullsoft winamp | = 5.0.1 | No fix listed |
| nullsoft winamp | = 5.0.2 | No fix listed |
| nullsoft winamp | = 5.01 | No fix listed |
| nullsoft winamp | = 5.1 | No fix listed |
| nullsoft winamp | = 5.02 | No fix listed |
| nullsoft winamp | = 5.2 | No fix listed |
| nullsoft winamp | = 5.3 | No fix listed |
| nullsoft winamp | = 5.03 | No fix listed |
| nullsoft winamp | = 5.03a | No fix listed |
| nullsoft winamp | = 5.04 | No fix listed |
| nullsoft winamp | = 5.05 | No fix listed |
| nullsoft winamp | = 5.5 | No fix listed |
| nullsoft winamp | = 5.06 | No fix listed |
| nullsoft winamp | = 5.07 | No fix listed |
| nullsoft winamp | = 5.08 | No fix listed |
| nullsoft winamp | = 5.08c | No fix listed |
| nullsoft winamp | = 5.08d | No fix listed |
| nullsoft winamp | = 5.08e | No fix listed |
| nullsoft winamp | = 5.09 | No fix listed |
| nullsoft winamp | = 5.11 | No fix listed |
| nullsoft winamp | = 5.12 | No fix listed |
| nullsoft winamp | = 5.13 | No fix listed |
| nullsoft winamp | = 5.21 | No fix listed |
| nullsoft winamp | = 5.22 | No fix listed |
| nullsoft winamp | = 5.23 | No fix listed |
| nullsoft winamp | = 5.24 | No fix listed |
| nullsoft winamp | = 5.31 | No fix listed |
| nullsoft winamp | = 5.32 | No fix listed |
| nullsoft winamp | = 5.33 | No fix listed |
| nullsoft winamp | = 5.34 | No fix listed |
| nullsoft winamp | = 5.35 | No fix listed |
| nullsoft winamp | = 5.36 | No fix listed |
| nullsoft winamp | = 5.51 | No fix listed |
| nullsoft winamp | = 5.52 | No fix listed |
| nullsoft winamp | = 5.53 | No fix listed |
| nullsoft winamp | = 5.091 | No fix listed |
| nullsoft winamp | = 5.093 | No fix listed |
| nullsoft winamp | = 5.094 | No fix listed |
| nullsoft winamp | = 5.111 | No fix listed |
| nullsoft winamp | = 5.112 | No fix listed |
References
- blog.watchfire.com
- forums.winamp.com patch
- 31371 patch third-party-advisory vendor-advisory
- 30539 patch vdb-entry
- winamp-nowplaying-unspecified(44207) vdb-entry
- oval:org.mitre.oval:def:15716 signature vdb-entry