CVE-2009-2206 Memory corruption in n/a
Remote attackers can execute arbitrary code or crash the device via crafted audio files due to heap overflows in CoreAudio.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2009-2206?
CVE-2009-2206 is a medium-severity memory corruption vulnerability in Apple Iphone Os, published on 10 Sep 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple heap-based buffer overflows in the AudioCodecs library in the CoreAudio component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted (1) AAC or (2) MP3 file, as demonstrated by a ringtone with malformed entries in the sample size table.
Weakness: CWE-119
Which versions are affected by CVE-2009-2206?
It affects 2 products.
Products include Apple Iphone Os, Apple Ipod Touch.
How do I fix CVE-2009-2206?
No fix has been published for CVE-2009-2206 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2009-2206 being exploited?
There is no known exploitation of CVE-2009-2206 in the wild and no public exploit code.
Other vulnerabilities in Apple Iphone Os
Sources
Also known as GHSA-3r8c-x2gq-vxw3.