Secunia

Some vulnerabilities have been reported in Winamp, which can be exploited by malicious people to compromise a user's system.

1) Multiple errors in the FLAC library can be exploited to cause heap-based or stack-based buffer overflows via specially-crafted FLAC media files.

For more information:
SA27210

The vulnerabilities are reported in version 5.35. Other versions may also be affected.

2) Multiple boundary errors in in_mp4.dll when processing certain MP4 atoms (aART, ©alb, ©ART, ©cmt, ©day, ©gen, ©nam, ©wrt) can be exploited to cause stack-based buffer overflows via a specially crafted MP4 file.

Successful exploitation allows execution of arbitrary code but requires that the user is tricked into opening a malicious MP4 file and clicking "Update" on the "File Info" window (Alt+3).

The vulnerabilities are confirmed in version 5.32, 5.33, 5.34, and 5.35. Other versions may also be affected.

Solution
Update to version 5.5.
Further details available in Customer Area

Provided and/or discovered by
1) Discovered by Sean de Regge, reported via iDefense Labs.
2) SYS 49152

Changelog
Further details available in Customer Area

Original Advisory
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608

milw0rm:
http://milw0rm.com/exploits/4703

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area