CVE-2009-0135: Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amar...

Security readout for executives and security teams

CVE-2009-0135 is a memory corruption flaw in Amarok’s Audible Audio metadata parser. A malicious .aa file could cause affected Amarok versions to run attacker-controlled code. This is primarily a workstation or media-handling risk, especially where users open untrusted audio files. Exposure is likely limited to systems running affected Amarok versions or distribution packages derived from them. Organizations should focus on Linux desktops, media workstations, shared analysis systems, and any environment where untrusted .aa files may be opened or indexed. Prioritize remediation where Amarok is installed on user-facing or file-processing systems. Business urgency is lower than internet-exposed RCE, but arbitrary code execution from a media file can still compromise endpoints and user data. Mitigation focus: Inventory systems for Amarok 1.4.10 through 2.0.1.; Apply fixed packages from the relevant distribution advisory.; Avoid opening untrusted Audible Audio .aa files until remediated..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.