Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 7 Feb 2009 10:45:11 -0600
From: Will Drewry <>
Subject: [oCERT-2009-002] OpenCORE insufficient bounds checking during MP3 

#2009-002 OpenCORE insufficient bounds checking during MP3 decoding


OpenCORE, an open source multimedia decoding subsystem, suffers from an
integer underflow during Huffman decoding resulting in improper bounds
checking when writing to a heap allocated buffer.  Decoding a specially
crafted mp3 file will result in unexpected process termination or,
potentially, arbitrary code execution due to heap corruption.

Patches have been made available by PacketVideo:,8815

Affected version:

OpenCore <= 2.0

(secondary affected versions)

Android without change 8815

Fixed version:

OpenCore >= 2.0 with change 8815

Android with change 8815

Credit: Initial vulnerability report and sample crasher provided by
        Owen Arden <> and
        Charlie Miller <>.
        Thanks to PacketVideo for the comprehensive analysis and

CVE: CVE-2009-0475

2009-01-21: Android Security Team informed of issue
2009-01-23: Android Security Team requested coordination aid from oCERT
2009-01-24: oCERT investigated for other potential affected projects
2009-02-05: vendor supplied patch
2009-02-05: vendor indicated that no other open source projects affected
2009-02-05: did not discover other open source projects affected
2009-02-05: emailed as a cross-check
2009-02-06: supplied vulnerability analysis to upstream vendor
2009-02-06: walked through affected code with upstream vendor
2009-02-06: CVE assignment requested and received
2009-02-07: advisory published




Will Drewry <>
oCERT Team ::

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.