Severity: Medium
Clementine Music Player v. <= 1.3.1 is affected by a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207
.
The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine.
Attackers could exploit this issue to cause a crash (DoS) of the clementine.exe process or achieve arbitrary code execution in the context of the current logged-in Windows user.
eax=00000080 ebx=00000000 ecx=e6f6bc6d edx=00000000 esi=00000000 edi=54d40bb8 eip=007aa207 esp=561af1f8 ebp=561af280 iopl=0 nv up ei pl nz na po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 clementine+0x3aa207: 007aa207 894604 mov dword ptr [esi+4],eax ds:002b:00000004=???????? FAILURE_BUCKET_ID: NULL_CLASS_PTR_WRITE_AVRF_c0000005_clementine.exe!Unknown Basic Block: 007aa207 mov dword ptr [esi+4],eax Tainted Input operands: 'eax','esi' 007aa20a mov eax,dword ptr [ebp+0ch] 007aa20d mov dword ptr [esi+8],eax 007aa210 lock inc dword ptr [qtcore4!zn9qlistdata11shared_nulle (6e200074)] 007aa217 setne al 007aa21a mov eax,dword ptr [esi] 007aa21c mov dword ptr [esi],offset qtcore4!zn9qlistdata11shared_nulle (6e200074) 007aa222 lock dec dword ptr [eax] 007aa225 setne dl 007aa228 test dl,dl 007aa22a jne clementine+0x3aa23b (007aa23b) Exception Hash (Major/Minor): 0xf535c3f1.0x4c51c076 Hash Usage : Stack Trace: Major+Minor : clementine+0x3aa207 Major+Minor : clementine+0x2555e4 Major+Minor : libgobject_2_0_0!g_cclosure_marshal_VOID__OBJECTv+0x46 Instruction Address: 0x00000000007aa207 Description: User Mode Write AV near NULL Short Description: WriteAVNearNull Exploitability Classification: UNKNOWN Recommended Bug Title: User Mode Write AV near NULL starting at clementine+0x00000000003aa207 (Hash=0xf535c3f1.0x4c51c076)