PT-2009-1261 · Divx · Divx Web Player

Published 2009-04-16 · Updated 2018-10-11 · CVE-2008-5259

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DivX Web Player versions 1.4.2.7 and earlier

Description The issue is caused by an integer signedness error that allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format (STRF) chunk. This triggers a heap-based buffer overflow.

Recommendations For DivX Web Player versions 1.4.2.7 and earlier, update to a version that fixes the integer signedness error to prevent remote code execution.

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-5259

Affected Products

Divx Web Player

References · 9

• http://vupen.com/english/advisories/2009/1044 · Vendor Advisory
• http://secunia.com/advisories/33196 · Vendor Advisory
• http://secunia.com/secunia_research/2008-57 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5259 · Security Note
• http://securitytracker.com/id?1022061 · Note
• http://securityfocus.com/bid/34523 · Note
• http://securityfocus.com/archive/1/502701/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49908 · Note
• http://xforce.iss.net/xforce/xfdb/49908 · Note