CVE-2007-1543 (High) :
Stack-based buffer overflow in the accept_att_local function in server/os/connection.c in Network
Audio System (NAS) before 1.8a SVN 237 allows remote attackers to execute arbitrary code via a
long path slave name in a USL socket connection.
CVE-2007-1544 (Medium) :
Integer overflow in the ProcAuWriteElement function in server/dia/audispatch.c in Network Audio
System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash)
and possibly execute arbitrary code via a large max_samples value.
CVE-2007-1545 (Medium) :
The AddResource function in server/dia/resource.c in Network Audio System (NAS) before 1.8a
SVN 237 allows remote attackers to cause a denial of service (server crash) via a nonexistent
client ID.
CVE-2007-1546 (Medium) :
Array index error in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to
cause a denial of service (crash) via (1) large num_action values in the ProcAuSetElements
function in server/dia/audispatch.c or (2) a large inputNum parameter to the compileInputs function
in server/dia/auutil.c.
CVE-2007-1547 (High) :
The ReadRequestFromClient function in server/os/io.c in Network Audio System (NAS) before
1.8a SVN 237 allows remote attackers to cause a denial of service (crash) via multiple
simultaneous connections, which triggers a NULL pointer dereference.
CVE-2006-4089 (Medium) :
Multiple buffer overflows in Andy Lo-A-Foe AlsaPlayer 0.99.76 and earlier allow remote attackers
to cause a denial of service (application crash), or have other unknown impact, via (1) a long
Location field sent by a web server, which triggers an overflow in the reconnect function in
reader/http/http.c; (2) a long URL sent by a web server when AlsaPlayer is seeking a media file
for the playlist, which triggers overflows in new_list_item and CbUpdated in
interface/gtk/PlaylistWindow.cpp; and (3) a long response sent by a CDDB server, which triggers
an overflow in cddb_lookup in input/ccda/cdda_engine.c.
CVE-2007-5301 (Medium) :
Buffer overflow in the vorbis_stream_info function in input/vorbis/vorbis_engine.c (aka the vorbis
input plugin) in AlsaPlayer before 0.99.80-rc3 allows remote attackers to execute arbitrary code
via a .OGG file with long comments.
Alejandro Mery
Christian Wiese
Aldas Nabazas
Nagy Karoly Gabriel
Minto van der Sluis