CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-9133 – KMPlayer Subtitles parser Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2019-9133
When processing subtitles format media file, KMPlayer version 2018.12.24.14 or lower doesn't check object size correctly, which leads to integer underflow then to memory out-of-bound read/write. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file. Al procesar archivos multimedia en formato de subtítulos, KMPlayer versión 2018.12.24.14 o anterior, no comprueba el tamaño del objeto correctamente, lo que conduce al subdesbordamiento de enteros y luego la lectura/escritura de la memoria fuera del limite. Un atacante puede explotar este problema induciendo a un usuario desprevenido para abrir un archivo malicioso. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4D55BLGBNWNIMNI5N57WDPAFQCUIM6XX https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT5HBIKH64YRZFFAPXGOTHIQJHSTQJF7 https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34991 • CWE-190: Integer Overflow or Wraparound CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2018-5200 – KMPlayer Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2018-5200
KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The problem is that more frame data is copied to heap memory than the size specified in the frame header. This results in a memory corruption and remote code execution. KMPlayer, en versiones 4.2.2.15 y anteriores, tiene una vulnerabilidad de desbordamiento de búfer basado en memoria dinámica (heap). • https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30113 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2012-3841
https://notcve.org/view.php?id=CVE-2012-3841
Untrusted search path vulnerability in KMPlayer 3.2.0.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ehtrace.dll that is located in the current working directory. Vulnerabilidad de ruta de búsqueda no confiable en KMPlayer v3.2.0.19, permite a usuarios locales ejecutar código de su elección y llevar a cabo un secuestro de DLL a través de un caballo de Troya en ehtrace.dll que se encuentre en el directorio actual de trabajo. • http://osvdb.org/81558 http://packetstormsecurity.org/files/112218/KMPlayer-3.2.0.19-DLL-Hijack.html https://exchange.xforce.ibmcloud.com/vulnerabilities/75193 •