Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute
    arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2)
    the parse_trak_atom function in the QT plugin (plugins/qtextractor.c). (CVE-2006-2458)

Fix heap overflow in the asf plugin (CVE-2006-2458) [# 176280]. Fix heap overflow in the qt plugin (CVE-2006-2458) [# 176280].

Luigi Auriemma discovered a buffer overflow in the processing of ASF files in libextractor, a library to extract arbitrary meta-data from files, which can lead to the execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200605-14 (libextractor: Two heap-based buffer overflows)

    Luigi Auriemma has found two heap-based buffer overflows in     libextractor 0.5.13 and earlier: one of them occurs in the     asf_read_header function in the ASF plugin, and the other occurs in the     parse_trak_atom function in the Qt plugin.
  Impact :

    By enticing a user to open a malformed file using an application     that employs libextractor and its ASF or Qt plugins, an attacker could     execute arbitrary code in the context of the application running the     affected library.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
446720	SCA: security update for extractor (GHSA-f836-7jqw-3684)	Tenable Cloud Security	SCA Checks	Local	high
446720	SCA: security update for extractor (GHSA-f836-7jqw-3684)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
27321	openSUSE 10 Security Update : libextractor (libextractor-1426)	Nessus	SuSE Local Security Checks	Local	medium
22623	Debian DSA-1081-1 : libextractor - buffer overflow	Nessus	Debian Local Security Checks	Local	medium
21578	GLSA-200605-14 : libextractor: Two heap-based buffer overflows	Nessus	Gentoo Local Security Checks	Local	medium

Detections

Analytics

CVE-2006-2458

high

Tenable Plugins

high

high

medium

medium

medium