CVE:CVE-2009-0186
CNNVD:CNNVD-200903-080
libsndfile是软件开发者Erik de Castro Lopo所研发的一个通过标准接口读写AIFF、AU和WAV等格式的音频文件的C库。
libsndfile.dll库在解析CAF描述块时存在整数溢出，最终可能导致堆溢出。如果用户受骗使用链接到该库的播放器打开了特制的CAF音频文件的话，就可以触发这个溢出，导致执行任意代码。
solution:Upgrade nullsoft winamp to a higher version than 5.55,5.541,and avoid the version 5.55,5.541; Upgrade mega-nerd libsndfile to a higher version than 1.0.18,0.0.8,0.0.28,1.0.0,1.0.0:rc1,1.0.0:rc6,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.0.9,1.0.10,1.0.11,1.0.12,1.0.13,1.0.14,1.0.15,1.0.16,1.0.17,and avoid the version (,1.0.18],0.0.8,0.0.28,1.0.0,1.0.0:rc1,1.0.0:rc6,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.0.9,1.0.10,1.0.11,1.0.12,1.0.13,1.0.14,1.0.15,1.0.16,1.0.17