CVE-2009-0698
Published: 23 February 2009
Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385.
Notes
| Author | Note |
|---|---|
| mdeslaur | when fixing this, also add in patch for CVE-2008-5239 regression: http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=b11cc37934629a2965859163db6095fbbe2b44be;style=gitweb details: http://bugs.xine-project.org/show_bug.cgi?id=204 details: https://bugs.launchpad.net/ubuntu/+source/xine-lib/+bug/322834 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
xine-lib Launchpad, Ubuntu, Debian |
upstream |
Needs triage
|
| dapper |
Released
(1.1.1+ubuntu2-7.11)
|
|
| gutsy |
Released
(1.1.7-1ubuntu1.5)
|
|
| hardy |
Released
(1.1.11.1-1ubuntu3.3)
|
|
| intrepid |
Released
(1.1.15-0ubuntu3.2)
|
|
|
Patches: upstream: http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=ba872682eba8a10217c48b7fe21f0fa763ef4af3;style=gitweb |
||