CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-9133 – KMPlayer Subtitles parser Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2019-9133
When processing subtitles format media file, KMPlayer version 2018.12.24.14 or lower doesn't check object size correctly, which leads to integer underflow then to memory out-of-bound read/write. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file. Al procesar archivos multimedia en formato de subtítulos, KMPlayer versión 2018.12.24.14 o anterior, no comprueba el tamaño del objeto correctamente, lo que conduce al subdesbordamiento de enteros y luego la lectura/escritura de la memoria fuera del limite. Un atacante puede explotar este problema induciendo a un usuario desprevenido para abrir un archivo malicioso. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4D55BLGBNWNIMNI5N57WDPAFQCUIM6XX https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT5HBIKH64YRZFFAPXGOTHIQJHSTQJF7 https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34991 • CWE-190: Integer Overflow or Wraparound CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2018-5200 – KMPlayer Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2018-5200
KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The problem is that more frame data is copied to heap memory than the size specified in the frame header. This results in a memory corruption and remote code execution. KMPlayer, en versiones 4.2.2.15 y anteriores, tiene una vulnerabilidad de desbordamiento de búfer basado en memoria dinámica (heap). • https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30113 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 5%CPEs: 1EXPL: 0CVE-2011-2594
https://notcve.org/view.php?id=CVE-2011-2594
Heap-based buffer overflow in KMPlayer 3.0.0.1441, and possibly other versions, allows remote attackers to execute arbitrary code via a playlist (.KPL) file with a long Title field. Desbordamiento de buffer basado en memoria dinámica en KMPlayer v3.0.0.1441, y posiblemente otras versiones, permiten a atacantes remotos ejecutar código de su elección a través un archivo de una lista de reproducción (.KPL) con campo Title largo. • http://secunia.com/advisories/45264 http://www.securityfocus.com/bid/49342 https://exchange.xforce.ibmcloud.com/vulnerabilities/69451 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •