What’s Vulnerable › Vulnerabilities

CVE-2006-4197

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2006-08-17 · updated 2026-06-16

Description

Multiple buffer overflows in libmusicbrainz (aka mb_client or MusicBrainz Client Library) 2.1.2 and earlier, and SVN 8406 and earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a long Location header by the HTTP server, which triggers an overflow in the MBHttp::Download function in lib/http.cpp; and (2) a long URL in RDF data, as demonstrated by a URL in an rdf:resource field in an RDF XML document, which triggers overflows in many functions in lib/rdfparse.c.

Affected products

• Musicbrainz Libmusicbrainz: through 2.1.2
• Musicbrainz Libmusicbrainz Svn: through 8406

References

• http://aluigi.altervista.org/adv/brainzbof-adv.txt
• http://secunia.com/advisories/21404
• http://secunia.com/advisories/21668
• http://secunia.com/advisories/21699
• http://secunia.com/advisories/22191
• http://secunia.com/advisories/22393
• http://secunia.com/advisories/22517
• http://secunia.com/advisories/22639
• http://security.gentoo.org/glsa/glsa-200610-09.xml
• http://securityreason.com/securityalert/1399
• http://securitytracker.com/id?1016691
• http://www.debian.org/security/2006/dsa-1162

Get alerted when CVE-2006-4197 or the next vulnerability affects your stack