9.3

CVE-2008-5234

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c.  NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xine ≫ Xine-lib Version <= 1.1.14
Xine ≫ Xine-lib Version 0.9.13
Xine ≫ Xine-lib Version 1 Update rc0a
Xine ≫ Xine-lib Version 1 Update rc1
Xine ≫ Xine-lib Version 1 Update rc2
Xine ≫ Xine-lib Version 1 Update rc3
Xine ≫ Xine-lib Version 1 Update rc3a
Xine ≫ Xine-lib Version 1 Update rc3b
Xine ≫ Xine-lib Version 1 Update rc3c
Xine ≫ Xine-lib Version 1 Update rc4
Xine ≫ Xine-lib Version 1 Update rc4a
Xine ≫ Xine-lib Version 1 Update rc5
Xine ≫ Xine-lib Version 1 Update rc6a
Xine ≫ Xine-lib Version 1 Update rc7
Xine ≫ Xine-lib Version 1 Update rc8
Xine ≫ Xine-lib Version 1.0
Xine ≫ Xine-lib Version 1.0.1
Xine ≫ Xine-lib Version 1.0.2
Xine ≫ Xine-lib Version 1.0.3a
Xine ≫ Xine-lib Version 1.1.0
Xine ≫ Xine-lib Version 1.1.1
Xine ≫ Xine-lib Version 1.1.2
Xine ≫ Xine-lib Version 1.1.3
Xine ≫ Xine-lib Version 1.1.4
Xine ≫ Xine-lib Version 1.1.5
Xine ≫ Xine-lib Version 1.1.6
Xine ≫ Xine-lib Version 1.1.7
Xine ≫ Xine-lib Version 1.1.8
Xine ≫ Xine-lib Version 1.1.9
Xine ≫ Xine-lib Version 1.1.9.1
Xine ≫ Xine-lib Version 1.1.10
Xine ≫ Xine-lib Version 1.1.10.1
Xine ≫ Xine-lib Version 1.1.11
Xine ≫ Xine-lib Version 1.1.11.1
Xine ≫ Xine-lib Version 1.1.12
Xine ≫ Xine-lib Version 1.1.13
Xine ≫ Xine-lib Version 1_beta1
Xine ≫ Xine-lib Version 1_beta2
Xine ≫ Xine-lib Version 1_beta3
Xine ≫ Xine-lib Version 1_beta4
Xine ≫ Xine-lib Version 1_beta5
Xine ≫ Xine-lib Version 1_beta6
Xine ≫ Xine-lib Version 1_beta7
Xine ≫ Xine-lib Version 1_beta8
Xine ≫ Xine-lib Version 1_beta9
Xine ≫ Xine-lib Version 1_beta10
Xine ≫ Xine-lib Version 1_beta11
Xine ≫ Xine-lib Version 1_beta12
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.75% 0.921
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://secunia.com/advisories/31827
http://sourceforge.net/project/shownotes.php?release_id=619869
Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2009:020
http://www.vupen.com/english/advisories/2008/2382
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00174.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00385.html
http://securityreason.com/securityalert/4648
http://securitytracker.com/id?1020703
http://www.ocert.org/analysis/2008-008/analysis.txt
http://www.securityfocus.com/archive/1/495674/100/0/threaded
http://www.securityfocus.com/bid/30797
http://secunia.com/advisories/31502
Vendor Advisory
http://secunia.com/advisories/33544
https://exchange.xforce.ibmcloud.com/vulnerabilities/44633
https://exchange.xforce.ibmcloud.com/vulnerabilities/44647
https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00555.html