Remote Code Execution Vulnerability in Spotify Music Player
CVE-2018-1167

8.8HIGH

Key Information:

Vendor

Spotify

Status
Spotify Music Player
Vendor
CVE Published:
19 April 2018

What is CVE-2018-1167?

A vulnerability exists in the Spotify Music Player where improper validation of user-supplied strings in URI handlers can allow attackers to execute arbitrary code. This exploitation requires a target user to visit a malicious webpage or open a harmful file. Once the attack is successful, the attacker can run code in the context of the current process, potentially compromising the integrity of the system.

Affected Version(s)

Spotify Music Player 1.0.69.336

References

https://zerodayinitiative.com/advisories/ZDI-18-280
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.