USN-196-1: Xine library vulnerability

Releases

• Ubuntu 5.04
• Ubuntu 4.10

Details

Ulf Harnhammar discovered a format string vulnerability in the CDDB
module's cache file handling in the Xine library, which is
used by packages such as xine-ui, totem-xine, and gxine.

By tricking an user into playing a particular audio CD which has a
specially-crafted CDDB entry, a remote attacker could exploit this
vulnerability to execute arbitrary code with the privileges of the
user running the application. Since CDDB servers usually allow anybody
to add and modify information, this exploit does not even require a
particular CDDB server to be selected.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 5.04

• libxine1 -

Ubuntu 4.10

• libxine1 -

In general, a standard system update will make all the necessary changes.

References

• CVE-2005-2337

Related notices

• USN-195-1: ruby1.8