PT-2004-1011 · Xine · Xine-Lib

Publicado 2004-09-16 · Atualizado 2017-07-11 · CVE-2004-1379

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xine-lib version 1-rc5 and earlier

Description The issue is related to a heap-based buffer overflow in the DVD subpicture decoder. This can be exploited by remote attackers through a DVD or MPEG subpicture header where the second field reuses RLE data from the end of the first field, allowing them to execute arbitrary code. Multiple vulnerabilities in the libxine0 package may lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For xine-lib version 1-rc5 and earlier, consider updating to a version later than 1-rc5 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

BDU:2015-02404

CVE-2004-1379

DSA-657-1

Produtos afetados

Xine-Lib

Referências · 12

• http://xinehq.de/index.php/security/XSA-2004-5 · Aviso do Fabricante
• http://debian.org/security/2005/dsa-657 · Aviso do Fabricante
• http://gentoo.org/security/en/glsa/glsa-200409-30.xml · Correção, Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1379 · Nota de Segurança
• http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.320308 · Correção, Aviso do Fabricante
• http://debian.org/security/dsa-657 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17423 · Nota
• https://bdu.fstec.ru/vul/2015-02404 · Nota de Segurança
• http://securityfocus.com/bid/11205 · Correção
• http://securityfocus.com/archive/1/375482/2004-09-02/2004-09-08/0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1379 · Nota de Segurança
• http://vuxml.org/freebsd/131bd7c4-64a3-11d9-829a-000a95bc6fae.html · Nota