Xion Audio Player versions prior to 1.0.126 are vulnerable to a Unicode-based stack buffer overflow triggered by opening a specially crafted .m3u playlist file. This file contains an overly long string that overwrites the Structured Exception Handler (SEH) chain. As a result, an attacker can hijack execution flow and run arbitrary code.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2010-20042 |
Exploitation
To exploit this vulnerability, an attacker must create a specially crafted .m3u playlist file containing an overly long string. When the victim opens this file using a vulnerable version of Xion Audio Player, the stack buffer overflow occurs, allowing the attacker to execute arbitrary code on the victim’s machine.
Affected Products
- Xion Audio Player: A media player that is susceptible to buffer overflow vulnerabilities in versions prior to 1.0.126.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Xion Audio Player (1.0.126 or later) to ensure that the buffer overflow issue is resolved. Additionally, users should avoid opening untrusted .m3u playlist files.