PT-2008-6390 · Xine · Xine-Lib

Published 2008-11-26 · Updated 2009-11-24 · CVE-2008-5248

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions xine-lib versions prior to 1.1.15

Description The issue allows remote attackers to cause a denial of service, resulting in a crash, by using MP3 files with metadata consisting only of separators.

Recommendations For versions prior to 1.1.15, update to version 1.1.15 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-5248

Affected Products

Xine-Lib

References · 5

• http://mandriva.com/security/advisories?name=MDVSA-2009:298 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5248 · Security Note
• http://sourceforge.net/project/shownotes.php?release_id=619869 · Note
• http://securityfocus.com/bid/32505 · Note