CVE-2009-0698

Publication date 23 February 2009

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
xine-lib 8.10 intrepid
Fixed 1.1.15-0ubuntu3.2
8.04 LTS hardy
Fixed 1.1.11.1-1ubuntu3.3
7.10 gutsy
Fixed 1.1.7-1ubuntu1.5
6.06 LTS dapper
Fixed 1.1.1+ubuntu2-7.11

Notes

mdeslaur

when fixing this, also add in patch for CVE-2008-5239 regression: http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=b11cc37934629a2965859163db6095fbbe2b44be;style=gitweb details: http://bugs.xine-project.org/show_bug.cgi?id=204 details: https://bugs.launchpad.net/ubuntu/+source/xine-lib/+bug/322834

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
xine-lib

References

Related Ubuntu Security Notices (USN)

    • USN-763-1
    • xine-lib vulnerabilities
    • 20 April 2009
    • USN-746-1
    • xine-lib vulnerability
    • 26 March 2009

Other references