CVE-2009-0698
Published: 23 February 2009
Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385.
Priority
Status
Package | Release | Status |
---|---|---|
xine-lib Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
Patches: Upstream: http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=ba872682eba8a10217c48b7fe21f0fa763ef4af3;style=gitweb upstream: missing second part (see bug report) |
Notes
Author | Note |
---|---|
mdeslaur | when fixing this, also add in patch for CVE-2008-5239 regression: http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=b11cc37934629a2965859163db6095fbbe2b44be;style=gitweb details: http://bugs.xine-project.org/show_bug.cgi?id=204 details: https://bugs.launchpad.net/ubuntu/+source/xine-lib/+bug/322834 |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0698
- https://usn.ubuntu.com/usn/usn-746-1
- NVD
- Launchpad
- Debian