CVE-2006-2458

Name	CVE-2006-2458
Description	Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1081-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libextractor (PTS)	jessie, jessie (lts)	1:1.3-2+deb8u5	fixed
	stretch (security), stretch (lts), stretch	1:1.3-4+deb9u4	fixed
	buster	1:1.8-2+deb10u1	fixed
	bullseye	1:1.11-2	fixed
	bookworm	1:1.11-7	fixed
	sid, trixie	1:1.13-7	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libextractor	source	sarge	0.4.2-2sarge5		DSA-1081-1
libextractor	source	(unstable)	0.5.14-1