A brace of bugs in Winamp pose a serious security risk for users of the popular media player package, security watchers warn.

The buffer overflow-related flaws in Winamp 5.x create a means for hackers to take over vulnerable systems. Flaws in a library (in_mp3.dll) involved in parsing Ultravox streaming metadata open up the door to abuse, security notification firm Secunia warns. "These boundary errors can be exploited to cause stack-based buffer overflows via overly long '<artist>' and '<name>' tag values in the <metadata> section," it explains.

Secunia, whose researchers discovered the bugs, adds that successful exploitation allows the execution of arbitrary code. The vulnerabilities have been confirmed in versions 5.21, 5.5, and 5.51 of Winamp. Other versions may also be affected.

Users are advised to upgrade to Winamp version 5.52. Winamp is developed by Nullsoft, a subsidiary of AOL Music. ®

Related stories

• Winamp is still a thing? NOPE: It'll be silenced forever in December (20 November 2013)

  https://www.theregister.com/2013/11/20/winamp_to_disappear/

• Winamp plug-in backdoor wide open to viral penetration (1 December 2010)

  https://www.theregister.com/2010/12/01/winamp_security_update/

• WinAmp update fades out critical media player flaws (21 December 2009)

  https://www.theregister.com/2009/12/21/winamp_update/

• Amazon plugs video leak flaw (1 October 2008)

  https://www.theregister.com/2008/10/01/amazon_adobe_flaw_plugged/

• Adobe cache snafu delivers free movie downloads (29 September 2008)

  https://www.theregister.com/2008/09/29/adobe_caching_flaw/

• AOL plays nice, pays developers (24 December 2007)

  https://www.theregister.com/2007/12/24/aol_walled_garden/

• Media player users beware: more vulns ahead (10 December 2007)

  https://www.theregister.com/2007/12/10/3ivx_mp4_vuln/

• Poisoned MP4 files threaten Winamp users (2 May 2007)

  https://www.theregister.com/2007/05/02/winamp_0-day/

• Winamp exploit poses hacker risk (31 January 2006)

  https://www.theregister.com/2006/01/31/winamp_security_flap/

• AOL axes Nullsoft - whither Winamp, Shoutcast? (11 November 2004)

  https://www.theregister.com/2004/11/11/aol_axes_nullsoft/

• WinAmp flayed by skins attack (26 August 2004)

  https://www.theregister.com/2004/08/26/winamp_brown_alert/