PT-2008-6376 · Xine · Xine-Lib

Publicado

2008-11-26

·

Atualizado

2018-10-11

·

CVE-2008-5234

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions xine-lib versions 1.1.12 through 1.1.14 xine-lib version 1.1.15 (vector 1 may not be fixed)
Description The issue is related to multiple heap-based buffer overflows that can be exploited by remote attackers to execute arbitrary code. This is achieved through vectors related to a crafted metadata atom size processed by the parse moov atom function in demux qt.c and frame reading in the id3v23 interp frame function in id3.c.
Recommendations For xine-lib versions 1.1.12 through 1.1.14, update to version 1.1.15 or later. For xine-lib version 1.1.15, as vector 1 may not be fixed, consider disabling the parse moov atom function in demux qt.c until a patch is available. Restrict access to the id3v23 interp frame function in id3.c to minimize the risk of exploitation.

Correção

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-5234

Produtos afetados

Xine-Lib