CVE-2006-3600

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Multiple stack-based buffer overflows in the LookupTRM::lookup function in libtunepimp (TunePimp) 0.4.2 allow remote user-assisted attackers to cause a denial of service (application crash) and possibly execute code via a long (1) Album release date (MBE_ReleaseGetDate), (2) data, or (3) error strings.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.musicbrainz.org/ticket/1764
http://secunia.com/advisories/21026Patch, Vendor Advisory
http://secunia.com/advisories/21027Patch, Vendor Advisory
http://secunia.com/advisories/21106
http://secunia.com/advisories/21277Vendor Advisory
http://secunia.com/advisories/21323Vendor Advisory
http://security.gentoo.org/glsa/glsa-200607-11.xml
http://securitytracker.com/id?1016539
http://www.debian.org/security/2006/dsa-1135
http://www.mandriva.com/security/advisories?name=MDKSA-2006:126
http://www.osvdb.org/27094
http://www.securityfocus.com/bid/18961
http://www.ubuntu.com/usn/usn-318-1Patch
http://www.vupen.com/english/advisories/2006/2785Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27728
http://bugs.musicbrainz.org/ticket/1764
http://secunia.com/advisories/21026Patch, Vendor Advisory
http://secunia.com/advisories/21027Patch, Vendor Advisory
http://secunia.com/advisories/21106
http://secunia.com/advisories/21277Vendor Advisory
http://secunia.com/advisories/21323Vendor Advisory
http://security.gentoo.org/glsa/glsa-200607-11.xml
http://securitytracker.com/id?1016539
http://www.debian.org/security/2006/dsa-1135
http://www.mandriva.com/security/advisories?name=MDKSA-2006:126
http://www.osvdb.org/27094
http://www.securityfocus.com/bid/18961
http://www.ubuntu.com/usn/usn-318-1Patch
http://www.vupen.com/english/advisories/2006/2785Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27728

Timeline

Published: Jul 18, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-360110.0** UNVERIFIABLE ** Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke (.net nuke) allows remote attackers to gai CVE-2006-36025.0Directory traversal vulnerability in jscripts/tiny_mce/tiny_mce_gzip.php in FarsiNews 3.0 BETA 1 allows remote attackers to include arbitrar CVE-2006-36035.8Cross-site scripting (XSS) vulnerability in index.php in FlexWATCH Network Camera 3.0 and earlier allows remote attackers to inject arbitrar CVE-2006-36047.5Directory traversal vulnerability in FlexWATCH Network Camera 3.0 and earlier allows remote attackers to bypass access restrictions for (1) CVE-2006-36055.0Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Transition property on an uninitia CVE-2006-36065.0Unspecified vulnerability in Sun Solaris X Inter Client Exchange library (libICE) on Solaris 8 and 9 allows context-dependent attackers to c CVE-2006-36074.3Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote CVE-2006-36084.6The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled, does not restrict the extensions of upload CVE-2006-36094.3Cross-site scripting (XSS) vulnerability in index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to inject arbitrary web script CVE-2006-36105.0index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to obtain sensitive information (partial database schema) via a modified pa CVE-2006-36115.5Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via d CVE-2006-36122.6Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vec