PT-2004-1011 · Xine · Xine-Lib

Published 2004-09-16 · Updated 2017-07-11 · CVE-2004-1379

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xine-lib version 1-rc5 and earlier

Description The issue is related to a heap-based buffer overflow in the DVD subpicture decoder. This can be exploited by remote attackers through a DVD or MPEG subpicture header where the second field reuses RLE data from the end of the first field, allowing them to execute arbitrary code. Multiple vulnerabilities in the libxine0 package may lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For xine-lib version 1-rc5 and earlier, consider updating to a version later than 1-rc5 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-02404

CVE-2004-1379

DSA-657-1

Affected Products

Xine-Lib

References · 12

• http://xinehq.de/index.php/security/XSA-2004-5 · Vendor Advisory
• http://debian.org/security/2005/dsa-657 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1379 · Security Note
• https://bdu.fstec.ru/vul/2015-02404 · Security Note
• http://securityfocus.com/bid/11205 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-1379 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200409-30.xml · Patch, Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.320308 · Patch, Vendor Advisory
• http://debian.org/security/dsa-657 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17423 · Note
• http://securityfocus.com/archive/1/375482/2004-09-02/2004-09-08/0 · Note
• http://vuxml.org/freebsd/131bd7c4-64a3-11d9-829a-000a95bc6fae.html · Note