PT-2008-6383 · Xine · Xine-Lib

Will Drewry · Published 2008-11-26 · Updated 2018-10-11 · CVE-2008-5241

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions xine-lib versions 1.1.12 and earlier, including 1.1.15 and earlier

Description The issue is related to an integer underflow in the demux qt.c file, which can be triggered by a crafted media file. This results in a denial of service, causing the program to crash. The problem occurs when a compressed MOV file contains a small value of moov atom size, leading to the underflow.

Recommendations For xine-lib versions 1.1.12 and earlier, including 1.1.15 and earlier, update to a version that fixes the integer underflow issue in demux qt.c to prevent denial of service attacks.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-5241

Affected Products

Xine-Lib

References · 11

• http://mandriva.com/security/advisories?name=MDVSA-2009:020 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00174.html · Vendor Advisory
• http://securityfocus.com/bid/30797 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-5241 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00385.html · Vendor Advisory
• http://securityreason.com/securityalert/4648 · Note
• http://ocert.org/analysis/2008-008/analysis.txt · Note
• http://secunia.com/advisories/31827 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44656 · Note
• http://securityfocus.com/archive/1/495674/100/0/threaded · Note