openSUSE 10 Security Update : xine-devel (xine-devel-5113)

This update fixes a bug in the function sdpplinparse that allowed remote attackers to access process memory out-of a buffers bound. This vulnerability can be used to execute arbitrary code remotely if successfully exploited. CVE-2008-0073 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / current : xine-lib (SSA:2008-089-03)

New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2008-089-03. The text...

[slackware-security] xine-lib

New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2008-0073 Here are the details from the Slackware...

Fedora 8 : xine-lib-1.1.11-1.fc8 (2008-2569)

Wed Mar 19 2008 Ville Skytta - 1.1.11-1 - 1.1.11 security update, 438182, CVE-2008-0073. - Drop jack and wavpack build conditionals. - Specfile cleanups. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

DEBIAN-CVE-2008-0073

Array index error in the sdpplinparse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter...

Integer overflow

Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via 1 a crafted .FLV file, which triggers an overflow in demuxers/demuxflv.c; 2 a crafted .MOV file, which triggers an overflow in...

CVE-2008-1482

Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via 1 a crafted .FLV file, which triggers an overflow in demuxers/demuxflv.c; 2 a crafted .MOV file, which triggers an overflow in...

CVE-2008-0073

Array index error in the sdpplinparse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter...

Design/Logic Flaw

Array index error in the sdpplinparse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter...

CVE-2008-0073

Array index error in the sdpplinparse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter...

CVE-2008-0073

Array index error in the sdpplinparse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter...

CVE-2008-0073

Array index error in the sdpplinparse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter...

CVE-2008-0073

CVE-2008-0073 affects xine-lib, where an array indexing vulnerability in the SDP parser (sdpplin_parse in input/libreal/sdpplin.c) could allow a remote RTSP server to execute arbitrary code via a large SDP streamid parameter. Public advisories across distros (Ubuntu, Gentoo GLSA, Mandriva/MVL) de...

CVE-2008-1482

Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via 1 a crafted .FLV file, which triggers an overflow in demuxers/demuxflv.c; 2 a crafted .MOV file, which triggers an overflow in...

CVE-2008-1482

CVE-2008-1482 affects xine-lib up to version 1.1.11. The description documents multiple integer overflows that can be triggered by crafted media files (FLV, MOV, RM, MVE, MKV, CAK) parsed by various demuxers (demux_flv.c, demux_qt.c, demux_real.c, demux_wc3movie.c, ebml.c, demux_film.c). These ov...

CVE-2008-0073

Array index error in the sdpplinparse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter...

xine-lib多个堆溢出漏洞

BUGTRAQ ID: 28370 xine是一款免费的媒体播放器，支持多种格式。 xine在计算某些目标缓冲区和数组所需分配的内存数时错误的32位计算，导致xine-lib受多个堆溢出漏洞影响，可能允许攻击者控制寄存器和代码流。 以下是有漏洞的代码部分： ----------------------------- A demuxflv堆溢出 ----------------------------- src/demuxers/demuxflv.c： static int parseflvvardemuxflvt this, unsigned char buf, int size, ch...

[SECURITY] Fedora 8 Update: xine-lib-1.1.11-1.fc8

This package contains the Xine library. Xine is a free multimedia player. It can play back various media. It also decodes multimedia files from local disk drives, and displays multimedia streamed over the Internet. It interprets many of the most common multimedia formats available - and some of t...

xine-lib sdpplin_parse()函数远程溢出漏洞

BUGTRAQ ID: 28312 CVECAN ID: CVE-2008-0073 xine是一款免费的媒体播放器，支持多种格式。 xine的input/libreal/sdpplin.c文件中的sdpplinparse函数存在缓冲区溢出漏洞，如果恶意的RTSP流中包含有超长的SDP参数的话，就可能触发这个溢出，导致执行任意指令。 xine-lib 1.1.10.1 xine ---- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://xinehq.de/...

Multiple heap overflows in xine-lib 1.1.11

Luigi Auriemma Application: xine-lib http://xinehq.de Versions: = 1.1.11 Platforms: Linux, BSD, Solaris, Irix, MacOSX, Windows and others Bugs: A heap-overflow in demuxflv B heap-overflow in demuxqt C heap-overflow in demuxreal D heap-overflow in demuxwc3movie E heap-overflow in ebml F...