CVE-2018-14332

[Suggested description]
An issue was discovered in Clementine Music Player 1.3.1.
Clementine.exe is vulnerable to a user mode write access violation due to a NULL pointer dereference in the Init call in the MoodbarPipeline::NewPadCallback function in moodbar/moodbarpipeline.cpp.
The vulnerability is triggered when the user opens a malformed mp3 file.

------------------------------------------

[Vulnerability Type]
Buffer Overflow

------------------------------------------

[Vendor of Product]
Clementine

------------------------------------------

[Affected Product Code Base]
Clementine Music Player - 1.3.1-386-g62d1eb4

------------------------------------------

[Affected Component]
The application is vulnerable to a null pointer reference vulnerability at this line of codehttps://github.com/clementine-player/Clementine/blob/e5ab3e786f9adde12cec3cc90cfe8c1cc6b06320/src/moodbar/moodbarpipeline.cpp#L155

------------------------------------------

[Attack Type]
Local

------------------------------------------

[Impact Denial of Service]
true

------------------------------------------

[Attack Vectors]
The user has to open a malformed mp3 file to trigger the crash

------------------------------------------

[Reference]
https://github.com/MostafaSoliman/Security-Advisories/CVE-2018-14332
https://github.com/clementine-player/Clementine/issues/6078
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14332

------------------------------------------

[Discoverer]
Mostafa Soliman - SecureMisr