xine-lib NES Sound Format Demuxer Buffer Overflow

Hi there Original advisory: http://milw0rm.com/exploits/5458 There's another stack-based buffer overflow in demuxnfs.c line 111: this-copyright = strdup&header0x4E; line 189: char copyright100; line 208: sprintfcopyright, "C s", this-copyright; Regards Laurent Gaffi...

[slackware-security] xine-lib

New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues. An overflow was found in the Speex decoder that could lead to a crash or possible execution of arbitrary code. Xine-lib = 1.1.12 was also found to be vulnerable to a stack-based...

GLSA-200804-17 : Speex: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200804-17 Speex: User-assisted execution of arbitrary code oCERT reported that the Speex library does not properly validate the 'mode' value it derives from Speex streams, allowing for array indexing vulnerabilities inside multipl...

xine-lib NSF声音格式解码器demux_nsf.c栈溢出漏洞

BUGTRAQ ID: 28816 xine是一款免费的媒体播放器，支持多种格式。 xine-lib的src/demuxers/demuxnsf.c文件中的demuxnsfsendchunk函数没有正确地处理NSF声音格式： opennsffile: 109: this-title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title, this-currentsong, this-totalsongs;...

CVE-2008-1878

Stack-based buffer overflow in the demuxnsfsendchunk function in src/demuxers/demuxnsf.c in xine-lib 1.1.12 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long NSF title...

CVE-2008-1878

Stack-based buffer overflow in the demuxnsfsendchunk function in src/demuxers/demuxnsf.c in xine-lib 1.1.12 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long NSF title...

CVE-2008-1878

Stack-based buffer overflow in the demuxnsfsendchunk function in src/demuxers/demuxnsf.c in xine-lib 1.1.12 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long NSF title...

CVE-2008-1878

CVE-2008-1878 is a stack-based buffer overflow in xine-lib (demux_nsf_send_chunk in src/demuxers/demux_nsf.c) that allows a remote attacker to crash the application and potentially execute arbitrary code via a long NSF title, affecting xine-lib 1.1.12 and earlier. Public advisories across distrib...

PT-2008-3409 · Xine · Xine-Lib

Name of the Vulnerable Software and Affected Versions: xine-lib versions 1.1.12 and earlier Description: The issue is a stack-based buffer overflow in the demux nsf send chunk function, located in src/demuxers/demux nsf.c. This allows remote attackers to cause a denial of service, potentially...

[oCERT-2008-004] multiple speex implementations insufficient boundary checks

2008/04/17 2008-004 multiple speex implementations insufficient boundary checks Description: The reference speex decoder from the Speex library performs insufficient boundary checks on a header structure read from user input, this has been reported in oCERT-2008-002 advisory. Further investigatio...

CVE-2008-1878: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the demuxnsfsendchunk function in src/demuxers/demuxnsf.c in xine-lib 1.1.12 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long NSF title...

xinelib-overflow.txt

xine-lib title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title, this-currentsong, this-totalsongs; - Affected applications http://xinehq.de/index.php/releases - PoC perl -e 'print "\x4E\x45\x53\x4D\x1A\x01\x01\x01\x80\x80\x18\x8A\x03\x8A...

xine-lib <= 1.1.12 NSF demuxer Stack Overflow Vulnerability PoC

No description provided by source. xine-lib = 1.1.12 is prone to a stack-based buffer overflow in the NES Sound Format demuxerdemuxnsf.c. - Code opennsffile: 109: this-title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title,...

CVE-2008-1832

CVE-2008-1832 affects Cecilia 2.0.5: lib/prefs.tcl allows local users to overwrite arbitrary files via a symlink attack on the csvers temporary file. Connected advisories document remediation in Cecilia 2.0.5-282.2 for openSUSE GA media, and related vendor entries reference the same issue. The im...

Xine-Lib 1.1.12 - NSF demuxer Stack Overflow (PoC)

Xine-Lib 1.1.12 - NSF demuxer Stack Overflow PoC xine-lib title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title, this-currentsong, this-totalsongs; - Affected applications http://xinehq.de/index.php/releases - PoC perl -e 'print...

Xine-Lib 1.1.12 - NSF demuxer Stack Overflow (PoC)

xine-lib title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title, this-currentsong, this-totalsongs; - Affected applications http://xinehq.de/index.php/releases - PoC perl -e 'print "\x4E\x45\x53\x4D\x1A\x01\x01\x01\x80\x80\x18\x8A\x03\x8A...

xine-lib <= 1.1.12 NSF demuxer Stack Overflow Vulnerability PoC

Exploit for linux platform in category dos / poc =============================================================== xine-lib title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title, this-currentsong, this-totalsongs; - Affected applications...

CVE-2008-1832: Improper Link Resolution Before File Access

lib/prefs.tcl in Cecilia 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the csvers temporary file...

Fedora 7 : xine-lib-1.1.11.1-1.fc7 (2008-2945)

This updates xine-lib to 1.1.11.1, which fixes the following security vulnerabilities: CVE-2008-0073 array indexing fixed in 1.1.11, CVE-2008-1482 integer overflow fixed in 1.1.11.1. It also provides a versioned xine-lib plugin-abi so 3rd party packages installing plugins can use it instead of...

Fedora 8 : xine-lib-1.1.11.1-1.fc8 (2008-2849)

1.1.11.1 security update, 438663, CVE-2008-1482. Provide versioned xine- libplugin-abi so 3rd party packages installing plugins can use it instead of requiring a version of xine-lib. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...