[SECURITY] [DSA 1277-1] New XMMS packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1277-1 [email protected] http://www.debian.org/security/ Noah Meyerhans April 04, 2007 - ------------------------------------------------------------------------ Package : xmms Vulnerability :...

DSA-1277-1 xmms - several

Bulletin has no description...

USN-445-1: XMMS vulnerabilities

Sven Krewitt of Secunia Research discovered that XMMS did not correctly handle BMP images when loading GUI skins. If a user were tricked into loading a specially crafted skin, a remote attacker could execute arbitrary code with user privileges...

XMMS皮肤整数溢出和下溢漏洞

XMMS是一款开放源代码的多媒体播放程序。 XMMS处理皮肤文件存在问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 1，是处理皮肤bitmap图象时存在一个整数下溢问题，包含畸形头数据的皮肤图象可导致缓冲区溢出。 2，在处理皮肤bitmap图象时存在一个整数溢出问题，包含畸形头数据的皮肤图象可导致内存破坏。 XMMS 1.2.10 目前没有解决方案提供： http://www.xmms.org/...

XMMS multimedia player multiple integer overflows

Multiple integer overflows on different multimedia file formats parsing...

Secunia Research: XMMS Integer Overflow and Underflow Vulnerabilities

====================================================================== Secunia Research 21/03/2007 - XMMS Integer Overflow and Underflow Vulnerabilities - ===================================================================== Table of Contents Affected...

CVE-2007-0654

Integer underflow in X MultiMedia System xmms 1.2.10 allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image, which results in a stack-based buffer overflow...

CVE-2007-0653

Integer overflow in X MultiMedia System xmms 1.2.10, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image, which triggers memory corruption...

CVE-2007-0653

Integer overflow in X MultiMedia System xmms 1.2.10, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image, which triggers memory corruption...

CVE-2007-0654

Integer underflow in X MultiMedia System xmms 1.2.10 allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image, which results in a stack-based buffer overflow...

CVE-2007-0653

CVE-2007-0653 affects XMMS 1.2.10 and possibly earlier versions. Root cause: an integer overflow in the processing of skin bitmap images can trigger memory corruption, enabling user‑assisted remote code execution. Reported across multiple advisories; some Nessus/OpenVAS entries list the vulnerabi...

CVE-2007-0654

Integer underflow in X MultiMedia System xmms 1.2.10 allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image, which results in a stack-based buffer overflow...

xmms -- Integer Overflow And Underflow Vulnerabilities

Secunia reports: Secunia Research has discovered two vulnerabilities in XMMS, which can be exploited by malicious people to compromise a user's system. 1 An integer underflow error exists in the processing of skin bitmap images. This can be exploited to cause a stack-based buffer overflow via...

Festalon Heap Corruption

Luigi Auriemma Application: Festalon http://projects.raphnet.net/festalon Versions: = 0.5.5 and = 0.5.0 Platforms: Windows, nix, BSD, Winamp and XMMS plugin Bug: heap corruption in FESTAHESLoad Exploitation: local Date: 06 Aug 2006 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.o...

CVE-2003-1128

XMMS.pm in X2 XMMS Remote, as obtained from the vendor server between 4 AM 11 AM PST on May 7, 2003, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086...

CVE-2003-1128

CVE-2003-1128 describes a remote command execution vulnerability in XMMS.pm used by X2 XMMS Remote. An attacker can pass shell metacharacters in a request to TCP port 8086, enabling arbitrary commands execution on the affected system. The public records explicitly identify the vulnerable componen...

CVE-2003-1128

XMMS.pm in X2 XMMS Remote, as obtained from the vendor server between 4 AM 11 AM PST on May 7, 2003, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086...

XMMS Remote input validation error

Overview There is an input validation error in the stand-alone SOAP server XMMS Remote which allows unauthorized remote command execution. Description XMMS Remote is a stand-alone XML/SOAP HTTP server implemented in PERL created by X2 Studios. It is used to monitor a running xmms media player...