Lucene search

KrcertCVE-2019-9133

HistoryApr 09, 2019 - 6:29 p.m.

CVE-2019-9133

2019-04-0918:29:01

CWE-191

CWE-190

krcert

web.nvd.nist.gov

kmplayer

2018.12.24.14

subtitles

vulnerability

media file

nvd

cve-2019-9133

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

0.002

Percentile

54.8%

JSON

When processing subtitles format media file, KMPlayer version 2018.12.24.14 or lower doesn’t check object size correctly, which leads to integer underflow then to memory out-of-bound read/write. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file.

Affected configurations

Nvd

Node

kmplayerkmplayerRange≤2018.12.24.14

AND

microsoftwindowsMatch-

Node

fedoraprojectfedoraMatch29

fedoraprojectfedoraMatch30

VendorProductVersionCPE
kmplayerkmplayer*cpe:2.3:a:kmplayer:kmplayer:*:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
fedoraprojectfedora29cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
fedoraprojectfedora30cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
kmplayer	kmplayer	*	cpe:2.3:a:kmplayer:kmplayer::::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
fedoraproject	fedora	29	cpe:2.3:o:fedoraproject:fedora:29:::::::*
fedoraproject	fedora	30	cpe:2.3:o:fedoraproject:fedora:30:::::::*

CNA Affected

[
  {
    "platforms": [
      "x86, x64"
    ],
    "product": "KMPlayer",
    "vendor": "Pandora.tv",
    "versions": [
      {
        "lessThan": "2018.12.24.14",
        "status": "affected",
        "version": "KMPlayer",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4D55BLGBNWNIMNI5N57WDPAFQCUIM6XX/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT5HBIKH64YRZFFAPXGOTHIQJHSTQJF7/

www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34991

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

0.002

Percentile

54.8%

JSON

Related for CVE-2019-9133