CVE-2013-4695

Related Files

WinAmp 5.63 Null Pointer Dereference

Posted Jul 1, 2013

Authored by Julien Ahrens | Site security.inshell.net

An invalid pointer dereference vulnerability has been identified in WinAmp version 5.63. The application loads the contents of the %APPDATA%\WinAmp\links.xml on startup (the key lngId="default") and while browsing through the bookmarks in the Browser view of the GUI, but does not properly validate the length of the string loaded from the "<link name>" and "<home url>" keys before using them in a pointer call in the library gen_ff.dll, which leads to a invalid pointer dereference condition with possible code execution.

tags | advisory, code execution

advisories | CVE-2013-4695

SHA-256 | 99fc912aec9bf8e6915bfe5b9f35e6490007597a4a95e0a25c852c3364dc998f

Download | Favorite | View