PT-2008-6383 · Xine · Xine-Lib

Will Drewry · Publicado 2008-11-26 · Atualizado 2018-10-11 · CVE-2008-5241

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions xine-lib versions 1.1.12 and earlier, including 1.1.15 and earlier

Description The issue is related to an integer underflow in the demux qt.c file, which can be triggered by a crafted media file. This results in a denial of service, causing the program to crash. The problem occurs when a compressed MOV file contains a small value of moov atom size, leading to the underflow.

Recommendations For xine-lib versions 1.1.12 and earlier, including 1.1.15 and earlier, update to a version that fixes the integer underflow issue in demux qt.c to prevent denial of service attacks.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2008-5241

Produtos afetados

Xine-Lib

Referências · 11

• http://mandriva.com/security/advisories?name=MDVSA-2009:020 · Aviso do Fabricante
• http://securityreason.com/securityalert/4648 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00174.html · Aviso do Fabricante
• http://securityfocus.com/bid/30797 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-5241 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Aviso do Fabricante
• http://ocert.org/analysis/2008-008/analysis.txt · Nota
• http://secunia.com/advisories/31827 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44656 · Nota
• http://securityfocus.com/archive/1/495674/100/0/threaded · Nota
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00385.html · Aviso do Fabricante