xine-lib: User-assisted execution of arbitrary code

Background xine-lib is the core library package for the xine media player. Description Damian Frizza and Alfredo Ortega Core Security Technologies discovered a stack-based buffer overflow within the openflacfile function in the file demuxflac.c when parsing tags within a FLAC file CVE-2008-0486. ...

[ MDVSA-2008:046 ] - Updated xine-lib package fixes arbitrary code execution vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2008:046 http://www.mandriva.com/security/ Package : xine-lib Date : February 15, 2008 Affected: 2007.1, 2008.0 Problem Description: An array index vulnerability found in the FLAC audio demuxer might allow remote...

CVE-2008-0797: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in lib/download.php in iTheora 1.0 rc1 allows remote attackers to read arbitrary files via directory traversal sequences in the url parameter...

Fedora 8 : xine-lib-1.1.10.1-1.fc8 (2008-1543)

Fri Feb 8 2008 Ville Skytta - 1.1.10.1-1 - 1.1.10.1 security update, 431541. Sun Jan 27 2008 Ville Skytta - 1.1.10-2 - Include spu, spucc, and spucmml decoders 213597. Upstream release notes: http://sourceforge.net/project/shownotes.php?groupid=96 55&releaseid=574735 Note that Tenable Network...

Fedora 7 : xine-lib-1.1.10.1-1.fc7 (2008-1581)

Fri Feb 8 2008 Ville Skytta - 1.1.10.1-1 - 1.1.10.1 security update, 431541. Sun Jan 27 2008 Ville Skytta - 1.1.10-2 - Include spu, spucc, and spucmml decoders 213597. Upstream release notes: http://sourceforge.net/project/shownotes.php?groupid=96 55&releaseid=574735 Note that Tenable Network...

AIX 530005 : U807671

The remote host is missing AIX PTF U807671 which is related to the security of the package X11.motif.lib You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

Buffer overflow

Array index vulnerability in libmpdemux/demuxaudio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow...

CVE-2008-0486

Array index vulnerability in libmpdemux/demuxaudio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow...

CVE-2008-0486

Array index vulnerability in libmpdemux/demuxaudio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow...

CVE-2008-0486

Summary (CVE-2008-0486): An array index vulnerability in the FLAC tag handling of MPlayer’s demuxer (libmpdemux/demux_audio.c) could allow remote code execution via a crafted FLAC tag. Affected: MPlayer 1.0rc2 and SVN builds prior to r25917, and, due to code similarity, some xine-lib integrations...

CVE-2008-0486

Array index vulnerability in libmpdemux/demuxaudio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow...

CVE-2008-0486

Array index vulnerability in libmpdemux/demuxaudio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow...

CVE-2008-0486: Undefined Security Weakness

Array index vulnerability in libmpdemux/demuxaudio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow...

Debian Security Advisory DSA 1472-1 (xine-lib)

The remote host is missing an update to xine-lib announced via advisory DSA 1472-1. OpenVAS Vulnerability Test $Id: deb14721.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1472-1 xine-lib Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian: Security Advisory (DSA-1472-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 7 : xine-lib-1.1.10-1.fc7 (2008-1047)

Maintenance/security fix release 1.1.10. http://sourceforge.net/project/shownotes.php?groupid=9655&releaseid= 571608 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format...

GLSA-200801-12 : xine-lib: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200801-12 xine-lib: User-assisted execution of arbitrary code Luigi Auriemma reported that xine-lib does not properly check boundaries when processing SDP attributes of RTSP streams, leading to heap-based buffer overflows. Impact ...

Fedora 8 : xine-lib-1.1.10-1.fc8 (2008-1043)

Maintenance/security fix release 1.1.10. http://sourceforge.net/project/shownotes.php?groupid=9655&releaseid= 571608 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format...

openSUSE 10 Security Update : xine-devel (xine-devel-4916)

Specially crafted rtsp-Streams could cause a buffer overflow in xine. Attackers could potentially exploit that to execute arbitrary code CVE-2008-0225. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

xine-lib: User-assisted execution of arbitrary code

Background xine-lib is the core library package for the xine media player. Description Luigi Auriemma reported that xine-lib does not properly check boundaries when processing SDP attributes of RTSP streams, leading to heap-based buffer overflows. Impact An attacker could entice a user to play...