CVE-2009-1274

Integer overflow in the qterror parsetrakatom function in demuxers/demuxqt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow...

[TKADV2009-005] xine-lib Quicktime STTS Atom Integer Overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: xine-lib Quicktime STTS Atom Integer Overflow Advisory ID: TKADV2009-005 Revision: 1.0 Release Date: 2009/04/04 Last Modified: 2009/04/04 Date Reported: 2009/03/05 Author: Tobias Klein tk at trapkit.de Affected Software: xine-lib = version...

Slackware 12.0 / 12.1 / 12.2 / current : xine-lib (SSA:2009-098-03)

New xine-lib packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2009-098-03. The text itself is...

CVE-2009-1274: Improper Restriction of Operations within the Bounds of a Memory Buffer

Integer overflow in the qterror parsetrakatom function in demuxers/demuxqt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow...

xine-lib STTS QuickTime原子整数溢出漏洞

BUGTRAQ ID: 34384 xine是一款免费的媒体播放器，支持多种格式。 Xine-lib在解析Quicktime电影文件的畸形STTS原子时存在整数溢出漏洞，本地或远程攻击者可以利用这个漏洞以使用xine库应用程序的权限执行任意代码。以下是/src/demuxers/demuxqt.c中的有漏洞代码段： ... 840 static qterror parsetrakatom qttrak trak, 841 unsigned char trakatom ... 1535 else if currentatom == STTSATOM 1536 1537 / there...

xine-lib

New xine-lib packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2009-0385 Here are the details from the Slackware 12.2 ChangeLo...

xine-lib STTS QuickTime Atom远程缓冲区溢出漏洞

BUGTRAQ ID: 34384 CNCAN ID：CNCAN-2009040705 xine-lib是一款多媒体解码程序。 xine-lib处理STTS Quicktime atoms存在整数溢出错误，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 构建特殊的Quicktime文件，诱使用户解析，可触发此漏洞，并以应用程序权限执行任意指令。 xine xine-lib 1.1.16 2 xine xine-lib 1.1.16 1 xine xine-lib 1.1.16 xine xine-lib 1.1.15 xine xine-lib 1.1.14 xine xine-li...

Ubuntu USN-746-1 (xine-lib)

The remote host is missing an update to xine-lib announced via advisory USN-746-1. OpenVAS Vulnerability Test $Id: ubuntu7461.nasl 7969 2017-12-01 09:23:16Z santu $ $Id: ubuntu7461.nasl 7969 2017-12-01 09:23:16Z santu $ Description: Auto-generated from advisory USN-746-1 xine-lib Authors: Thomas...

Ubuntu: Security Advisory (USN-746-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-746-1: xine-lib vulnerability

It was discovered that the 4xm demuxer in xine-lib did not correctly handle a large currenttrack value in a 4xm file, resulting in an integer overflow. If a user or automated system were tricked into opening a specially crafted 4xm movie file, an attacker could crash xine-lib or possibly execute...

CVE-2009-1066: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the referral function in admin/lib/liblogs.php in Pixie CMS 1.01a allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header in a request...

Ubuntu Update for firefox-3.0, xulrunner-1.9 vulnerabilities USN-626-1

Ubuntu Update for Linux kernel vulnerabilities USN-626-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN6261.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for firefox-3.0, xulrunner-1.9 vulnerabilities USN-626-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks Gmb...

Ubuntu: Security Advisory (USN-635-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-435-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-433-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for xine-lib vulnerability USN-433-1

Ubuntu Update for Linux kernel vulnerabilities USN-433-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN4331.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for xine-lib vulnerability USN-433-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Ubuntu Update for xine-lib vulnerability USN-435-1

Ubuntu Update for Linux kernel vulnerabilities USN-435-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN4351.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for xine-lib vulnerability USN-435-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Ubuntu Update for xine-lib vulnerabilities USN-635-1

Ubuntu Update for Linux kernel vulnerabilities USN-635-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN6351.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for xine-lib vulnerabilities USN-635-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

CVE-2008-6347: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet comongumatimesheet20 2.0 4b component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

Directory traversal

Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the gpcltarlibdir parameter...