CVSS: 7.6EPSS: 79%CPEs: 4EXPL: 0CVE-2007-3035 – Microsoft Windows Media Player Malformed Skin Header Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2007-3035
Unspecified vulnerability in Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that is not properly handled during decompression, aka "Windows Media Player Code Execution Vulnerability Decompressing Skins." Una Vulnerabilidad no especificada en Microsoft Windows Media Player versiones 7.1, 9, 10 y 11 permite a atacantes remotos ejecutar código arbitrario por medio de un archivo skin (WMZ o WMD) con información de encabezado creada que no es manejada apropiadamente durante la descompresión, también se conoce como "Windows Media Player Code Execution Vulnerability Decompressing Skins." This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Windows Media Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists while decompressing skin files (.WMZ and .WMD) with malformed headers. During this process the malformed values are used to improperly calculate data which can later allow an attacker to execute code under the rights of the current user. • http://secunia.com/advisories/26433 http://securitytracker.com/id?1018565 http://www.securityfocus.com/archive/1/476548/100/0/threaded http://www.securityfocus.com/bid/25305 http://www.us-cert.gov/cas/techalerts/TA07-226A.html http://www.vupen.com/english/advisories/2007/2871 http://www.zerodayinitiative.com/advisories/ZDI-07-047.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-047 https://exchange.xforce.ibmcloud.com/vulnerabilities/35895 https:/& •
CVSS: 4.0EPSS: 64%CPEs: 4EXPL: 0CVE-2007-3037 – Microsoft Windows Media Player Skin Parsing Size Mismatch Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2007-3037
Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that causes a size mismatch between compressed and decompressed data and triggers a heap-based buffer overflow, aka "Windows Media Player Code Execution Vulnerability Parsing Skins." Microsoft Windows Media Player versiones 7.1, 9, 10 y 11 permite a los atacantes remotos ejecutar código arbitrario por medio de un archivo skin (WMZ o WMD) con información de encabezado creada que causa una falta de coincidencia de tamaño entre los datos comprimidos y descomprimidos y desencadena un desbordamiento de búfer en la región heap de la memoria, también se conoce como "Windows Media Player Code Execution Vulnerability Parsing Skins." This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Windows Media Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists during the parsing of malformed skin files (WMZ). A size compressed / decompressed size mismatch can result in an under allocated heap buffer which can be leveraged by an attacker to eventually execute arbitrary code under the context of the current user. • http://secunia.com/advisories/26433 http://securitytracker.com/id?1018565 http://www.osvdb.org/36385 http://www.securityfocus.com/archive/1/476533/100/0/threaded http://www.securityfocus.com/bid/25307 http://www.us-cert.gov/cas/techalerts/TA07-226A.html http://www.vupen.com/english/advisories/2007/2871 http://www.zerodayinitiative.com/advisories/ZDI-07-046.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-047 https://oval.cisecurity.org/rep • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 12%CPEs: 2EXPL: 2CVE-2006-6601 – Microsoft Windows Media Player 6.4/10.0 - MID Malformed Header Chunk Denial of Service
https://notcve.org/view.php?id=CVE-2006-6601
Windows Media Player 10.00.00.4036 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a .MID (MIDI) file with a malformed header chunk without any track chunks, possibly involving (1) number of tracks of (2) time division fields that are set to 0. Windows Media Player 10.00.00.4036 en Microsoft Windows XP SP2 permite a atacantes remotos con la intervención del usuario provocar una denegación de servicio mediante un archivo .MID (MIDI) con un trozo de cabecera mal formada sin ningún trozo de pista, posiblemente afectando (1) número de pistas (2), campos de división de tiempo establecidos a 0. • https://www.exploit-db.com/exploits/29285 https://www.exploit-db.com/exploits/2935 http://www.attrition.org/pipermail/vim/2006-December/001182.html http://www.securityfocus.com/archive/1/454505/100/0/threaded http://www.securityfocus.com/bid/21612 http://www.vupen.com/english/advisories/2006/5039 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 97%CPEs: 1EXPL: 1CVE-2006-6134
https://notcve.org/view.php?id=CVE-2006-6134
Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long HREF attribute, using an unrecognized protocol, in a REF element in an ASX PlayList file. Desbordamiento de búfer basado en montículo en la función WMCheckURLScheme de WMVCORE.DLL en Microsoft Windows Media Player (WMP) 10.00.00.4036 en Windows XP SP2, Server 2003, y Server 2003 SP1 permite a atacantes remotos provocar una denegación de servicio (cierre de aplicación) y ejecutar código de su elección mediante un atributo HREF largo, utilizando un protocolo no reconocido, en un elemento REF de un archivo de lista de reproducción ASX. • http://blogs.technet.com/msrc/archive/2006/12/07/public-proof-of-concept-code-for-asx-file-format-isssue.aspx http://research.eeye.com/html/alerts/zeroday/20061122.html http://secunia.com/advisories/22971 http://securityreason.com/securityalert/1922 http://securitytracker.com/id?1017354 http://support.avaya.com/elmodocs2/security/ASA-2006-274.htm http://www.kb.cert.org/vuls/id/208769 http://www.securityfocus.com/archive/1/452352/100/0/threaded http://www.securityfocus.com/a • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •