Severity: Medium
Clementine Music Player v. <= 1.3.1 is affected by a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207.
The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine.
Attackers could exploit this issue to cause a crash (DoS) of the clementine.exe process or achieve arbitrary code execution in the context of the current logged-in Windows user.
eip=007aa207 esp=561af1f8 ebp=561af280 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
clementine+0x3aa207:
007aa207 894604 mov dword ptr [esi+4],eax ds:002b:00000004=????????
FAILURE_BUCKET_ID: NULL_CLASS_PTR_WRITE_AVRF_c0000005_clementine.exe!Unknown
Basic Block:
007aa207 mov dword ptr [esi+4],eax
Tainted Input operands: 'eax','esi'
007aa20a mov eax,dword ptr [ebp+0ch]
007aa20d mov dword ptr [esi+8],eax
007aa210 lock inc dword ptr [qtcore4!zn9qlistdata11shared_nulle (6e200074)]
007aa217 setne al
007aa21a mov eax,dword ptr [esi]
007aa21c mov dword ptr [esi],offset qtcore4!zn9qlistdata11shared_nulle (6e200074)
007aa222 lock dec dword ptr [eax]
007aa225 setne dl
007aa228 test dl,dl
007aa22a jne clementine+0x3aa23b (007aa23b)
Exception Hash (Major/Minor): 0xf535c3f1.0x4c51c076
Hash Usage : Stack Trace:
Major+Minor : clementine+0x3aa207
Major+Minor : clementine+0x2555e4
Major+Minor : libgobject_2_0_0!g_cclosure_marshal_VOID__OBJECTv+0x46
Instruction Address: 0x00000000007aa207
Description: User Mode Write AV near NULL
Short Description: WriteAVNearNull
Exploitability Classification: UNKNOWN
Recommended Bug Title: User Mode Write AV near NULL starting at clementine+0x00000000003aa207 (Hash=0xf535c3f1.0x4c51c076)