CVE catalog

CVE-2006-4089

alsaplayer: CVE-2006-4089

[CVE catalog]

Severity
High
Published
Source
[NVD] · [CVE record]
EPSS
11.29% · Oct 25, 2026

Multiple buffer overflows in Andy Lo-A-Foe AlsaPlayer 0.99.76 and earlier allow remote attackers to cause a denial of service (application crash), or have other unknown impact, via (1) a long Location field sent by a web server, which triggers an overflow in the reconnect function in reader/http/http.c; (2) a long URL sent by a web server when AlsaPlayer is seeking a media file for the playlist, which triggers overflows in new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp; and (3) a long response sent by a CDDB server, which triggers an overflow in cddb_lookup in input/ccda/cdda_engine.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianalsaplayersid0.99.82-5fixed
Debianalsaplayerforky0.99.82-5fixed
Debianalsaplayertrixie0.99.82-2fixed
Debianalsaplayerbookworm0.99.81-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianalsaplayersourcesid0.99.76-9mediumNot reported[382842]
Debianalsaplayersourceforky0.99.76-9mediumNot reported[382842]
Debianalsaplayersourcetrixie0.99.76-9mediumNot reported[382842]
Debianalsaplayersourcebookworm0.99.76-9mediumNot reported[382842]

[Debian bug #382842]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [alsaplayer-alsa]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [alsaplayer-common]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [alsaplayer-daemon]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [alsaplayer-gtk]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [alsaplayer-jack]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [alsaplayer-nas]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [alsaplayer-oss]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [alsaplayer-text]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [alsaplayer-xosd]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [libalsaplayer0]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

  • [libalsaplayer-dev]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.81-2+b3 · amd64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

    • 0.99.81-2+b3 · arm64 · bookworm

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · bookworm; dsa · alsaplayer · debian · 12

[Debian 13 (Trixie)]

  • [alsaplayer-alsa]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.82-2+b1 · amd64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

    • 0.99.82-2+b1 · arm64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

  • [alsaplayer-common]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.82-2+b1 · amd64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

    • 0.99.82-2+b1 · arm64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

  • [alsaplayer-daemon]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.82-2+b1 · amd64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

    • 0.99.82-2+b1 · arm64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

  • [alsaplayer-jack]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.82-2+b1 · amd64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

    • 0.99.82-2+b1 · arm64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

  • [alsaplayer-nas]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.82-2+b1 · amd64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

    • 0.99.82-2+b1 · arm64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

  • [alsaplayer-oss]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.82-2+b1 · amd64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

    • 0.99.82-2+b1 · arm64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

  • [alsaplayer-text]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.82-2+b1 · amd64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

    • 0.99.82-2+b1 · arm64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

  • [alsaplayer-xosd]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.82-2+b1 · amd64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

    • 0.99.82-2+b1 · arm64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

  • [libalsaplayer0]Fixed

    Source package: [alsaplayer]

    Details (2)

    • 0.99.82-2+b1 · amd64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

    • 0.99.82-2+b1 · arm64 · trixie

      Fixed · Fixed: 0.99.76-9

      dsa · alsaplayer · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]