CVE-2009-0698

2009-02-2300:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.067 Low

EPSS

Percentile

93.8%

JSON

Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib
1.1.16.1 allows remote attackers to cause a denial of service (crash) and
possibly execute arbitrary code via a 4X movie file with a large
current_track value, a similar issue to CVE-2009-0385.

Bugs

<http://bugs.xine-project.org/show_bug.cgi?id=205>

Notes

Author	Note
mdeslaur	when fixing this, also add in patch for CVE-2008-5239 regression: http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=b11cc37934629a2965859163db6095fbbe2b44be;style=gitweb details: http://bugs.xine-project.org/show_bug.cgi?id=204 details: https://bugs.launchpad.net/ubuntu/+source/xine-lib/+bug/322834

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchxine-lib< 1.1.1+ubuntu2-7.11UNKNOWN
ubuntu7.10noarchxine-lib< 1.1.7-1ubuntu1.5UNKNOWN
ubuntu8.04noarchxine-lib< 1.1.11.1-1ubuntu3.3UNKNOWN
ubuntu8.10noarchxine-lib< 1.1.15-0ubuntu3.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	xine-lib	< 1.1.1+ubuntu2-7.11	UNKNOWN
ubuntu	7.10	noarch	xine-lib	< 1.1.7-1ubuntu1.5	UNKNOWN
ubuntu	8.04	noarch	xine-lib	< 1.1.11.1-1ubuntu3.3	UNKNOWN
ubuntu	8.10	noarch	xine-lib	< 1.1.15-0ubuntu3.2	UNKNOWN