2 lines
3.2 KiB
JSON
2 lines
3.2 KiB
JSON
{"affected":[{"affectedData":[{"platforms":["x86, x64"],"product":"KMPlayer","vendor":"Pandora.tv","versions":[{"lessThanOrEqual":"4.2.2.15","status":"affected","version":"KMPlayer","versionType":"custom"}]}],"source":"vuln@krcert.or.kr"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:pandora:kmplayer:*:*:*:*:*:*:*:*","matchCriteriaId":"9F987FD2-E794-42CF-8BD7-F554D9042086","versionEndIncluding":"4.2.2.15","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The problem is that more frame data is copied to heap memory than the size specified in the frame header. This results in a memory corruption and remote code execution."},{"lang":"es","value":"KMPlayer, en versiones 4.2.2.15 y anteriores, tiene una vulnerabilidad de desbordamiento de búfer basado en memoria dinámica (heap). Podría explotarse con un archivo de formato FLV manipulado. El problema es que se copian más datos del frame a la memoria heap que el tamaño especificado en la cabecera frame. Esto resulta en una corrupción de memoria y la ejecución remota de código."}],"id":"CVE-2018-5200","lastModified":"2026-06-17T01:59:49.870","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":6.8,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.6,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"vuln@krcert.or.kr","type":"Secondary"}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-12-20T14:29:00.760","references":[{"source":"vuln@krcert.or.kr","tags":["Third Party Advisory"],"url":"https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30113"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30113"}],"sourceIdentifier":"vuln@krcert.or.kr","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"nvd@nist.gov","type":"Primary"}]}
|