PT-2005-3809 · Xine · Xine-Lib

Ulf Harnhammar · Published 2005-10-14 · Updated 2017-07-11 · CVE-2005-2967

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xine-lib versions 1-beta through 1-beta 3 xine-lib versions 1-rc xine-lib versions 1.0 through 1.0.2 xine-lib version 1.1.1

Description The issue allows remote servers to execute arbitrary code via format string specifiers in metadata in CDDB server responses when the victim plays a CD. This occurs due to a format string vulnerability in the input cdda.c file.

Recommendations For xine-lib versions 1-beta through 1-beta 3, update to a version outside of this range to resolve the issue. For xine-lib version 1-rc, update to a version outside of this range to resolve the issue. For xine-lib versions 1.0 through 1.0.2, update to a version outside of this range to resolve the issue. For xine-lib version 1.1.1, update to a version outside of this range to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2005-2967

DSA-863-1

Affected Products

Xine-Lib

References · 20

• 🔥 http://securityfocus.com/bid/15044 · Exploit
• 🔥 https://exploit-db.com/exploits/1242 · Exploit
• http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.415454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2967 · Security Note
• http://debian.org/security/2005/dsa-863 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200510-08.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-196-1 · Vendor Advisory
• http://secunia.com/advisories/17099 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:180 · Vendor Advisory
• http://xinehq.de/index.php/security/XSA-2005-1 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_24_sr.html · Vendor Advisory
• http://secunia.com/advisories/17282 · Note
• http://secunia.com/advisories/17097 · Note
• http://secunia.com/advisories/17179 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22545 · Note