Heap overflow

Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the 1 id3v22interpframe and 2 id3v24interpframe functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-5248

xine-lib before 1.1.15 allows remote attackers to cause a denial of service crash via "MP3 files with metadata consisting only of separators."...

CVE-2008-5239

xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not properly handle a negative and b zero values during unspecified read function calls in inputfile.c, inputnet.c, inputsmb.c, and inputhttp.c, which allows remote attackers to cause a denial of service crash or possibly execute...

CVE-2008-5246

Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the 1 id3v22interpframe and 2 id3v24interpframe functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-5236

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary code via vectors related to 1 a crafted EBML element length processed by the parseblockgroup function in demuxmatroska.c; 2 a certain combination of sps, w,...

CVE-2008-5237

Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service crash or possibly execute arbitrary code via 1 crafted width and height values that are not validated by the mymngprocessheader function in demuxmng.c before u...

CVE-2008-5241

Integer underflow in demuxqt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allows remote attackers to cause a denial of service crash via a crafted media file that results in a small value of moovatomsize in a compressed MOV aka CMOVATOM...

CVE-2008-5247

The realparseaudiospecificdata function in demuxreal.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, uses an untrusted height aka codecdatalength value as a divisor, which allow remote attackers to cause a denial of service divide-by-zero error and crash via a zero value...

Buffer overflow

xine-lib before 1.1.15 performs V4L video frame preallocation before ascertaining the required length, which has unknown impact and attack vectors, possibly related to a buffer overflow in the openvideocapturedevice function in src/input/inputv4l.c...

CVE-2008-5237

Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service crash or possibly execute arbitrary code via 1 crafted width and height values that are not validated by the mymngprocessheader function in demuxmng.c before u...

CVE-2008-5235

Heap-based buffer overflow in the demuxrealsendchunk function in src/demuxers/demuxreal.c in xine-lib before 1.1.15 allows remote attackers to execute arbitrary code via a crafted Real Media file. NOTE: some of these details are obtained from third party information...

CVE-2008-5244

Unspecified vulnerability in xine-lib before 1.1.15 has unknown impact and attack vectors related to libfaad. NOTE: due to the lack of details, it is not clear whether this is an issue in xine-lib or in libfaad...

CVE-2008-5243

CVE-2008-5243 affects xine-lib (1.1.12 and earlier) where real_parse_headers uses an untrusted input length to reindex into an allocated buffer, enabling remote DoS via crafted media files. Multiple advisories (Gentoo GLSA 2010/06, Mandriva MDVSA-2009:319, SUSE security) enumerate related buffer/...

CVE-2008-5241

CVE-2008-5241: Integer underflow in xine-lib's demux_qt.c affects 1.1.12 and earlier 1.1.15 (and older); a crafted QuickTime/MOV file with a small moov_atom_size can crash the player (remote DoS). Remediation per Gentoo GLSA-201006-04 is to upgrade xine-lib to a fixed version (>= 1.1.16.3). Ot...

CVE-2008-5240

CVE-2008-5240 affects xine-lib 1.1.12 (and earlier 1.1.15) where untrusted input values influence memory allocation in demux_matroska.c (MATROSKA_ID_TR_CODECPRIVATE) and in demux_real.c (PROP_TAG, MDPR_TAG, CONT_TAG). This can lead to a NULL pointer dereference, crash, or possible arbitrary code ...

CVE-2008-5239

xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not properly handle a negative and b zero values during unspecified read function calls in inputfile.c, inputnet.c, inputsmb.c, and inputhttp.c, which allows remote attackers to cause a denial of service crash or possibly execute...

CVE-2008-5234

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to 1 a crafted metadata atom size processed by the parsemoovatom function in demuxqt.c and 2 frame reading in the id3v23interpframe...

CVE-2008-5237

CVE-2008-5237 affects xine-lib 1.1.12 and earlier 1.1.15 and older. Two overflow paths: (1) mymng_process_header uses crafted width/height values in demux_mng.c, leading to a crash or potential code execution, and (2) parse_reference_atom uses crafted current_atom_size and string_size in demux_qt...

CVE-2008-5234

CVE-2008-5234 affects xine-lib 1.1.12 and earlier than 1.1.15. The issue consists of multiple heap-based buffer overflows in demux_qt.c (parse_moov_atom) and id3.c (id3v23_interp_frame) that enable remote code execution. Gentoo GLSA and SUSE/Mandriva advisories indicate these issues are fixed in ...

CVE-2008-5246

Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the 1 id3v22interpframe and 2 id3v24interpframe functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are...