9.3

CVE-2008-5234

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c.  NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xine ≫ Xine-lib Version <= 1.1.14
Xine ≫ Xine-lib Version0.9.13
Xine ≫ Xine-lib Version1 Updaterc0a
Xine ≫ Xine-lib Version1 Updaterc1
Xine ≫ Xine-lib Version1 Updaterc2
Xine ≫ Xine-lib Version1 Updaterc3
Xine ≫ Xine-lib Version1 Updaterc3a
Xine ≫ Xine-lib Version1 Updaterc3b
Xine ≫ Xine-lib Version1 Updaterc3c
Xine ≫ Xine-lib Version1 Updaterc4
Xine ≫ Xine-lib Version1 Updaterc4a
Xine ≫ Xine-lib Version1 Updaterc5
Xine ≫ Xine-lib Version1 Updaterc6a
Xine ≫ Xine-lib Version1 Updaterc7
Xine ≫ Xine-lib Version1 Updaterc8
Xine ≫ Xine-lib Version1.0
Xine ≫ Xine-lib Version1.0.1
Xine ≫ Xine-lib Version1.0.2
Xine ≫ Xine-lib Version1.0.3a
Xine ≫ Xine-lib Version1.1.0
Xine ≫ Xine-lib Version1.1.1
Xine ≫ Xine-lib Version1.1.2
Xine ≫ Xine-lib Version1.1.3
Xine ≫ Xine-lib Version1.1.4
Xine ≫ Xine-lib Version1.1.5
Xine ≫ Xine-lib Version1.1.6
Xine ≫ Xine-lib Version1.1.7
Xine ≫ Xine-lib Version1.1.8
Xine ≫ Xine-lib Version1.1.9
Xine ≫ Xine-lib Version1.1.9.1
Xine ≫ Xine-lib Version1.1.10
Xine ≫ Xine-lib Version1.1.10.1
Xine ≫ Xine-lib Version1.1.11
Xine ≫ Xine-lib Version1.1.11.1
Xine ≫ Xine-lib Version1.1.12
Xine ≫ Xine-lib Version1.1.13
Xine ≫ Xine-lib Version1_beta1
Xine ≫ Xine-lib Version1_beta2
Xine ≫ Xine-lib Version1_beta3
Xine ≫ Xine-lib Version1_beta4
Xine ≫ Xine-lib Version1_beta5
Xine ≫ Xine-lib Version1_beta6
Xine ≫ Xine-lib Version1_beta7
Xine ≫ Xine-lib Version1_beta8
Xine ≫ Xine-lib Version1_beta9
Xine ≫ Xine-lib Version1_beta10
Xine ≫ Xine-lib Version1_beta11
Xine ≫ Xine-lib Version1_beta12
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.75% 0.921
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://secunia.com/advisories/31827
http://sourceforge.net/project/shownotes.php?release_id=619869
Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2009:020
http://www.vupen.com/english/advisories/2008/2382
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00174.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00385.html
http://securityreason.com/securityalert/4648
http://securitytracker.com/id?1020703
http://www.ocert.org/analysis/2008-008/analysis.txt
http://www.securityfocus.com/archive/1/495674/100/0/threaded
http://www.securityfocus.com/bid/30797
http://secunia.com/advisories/31502
Vendor Advisory
http://secunia.com/advisories/33544
https://exchange.xforce.ibmcloud.com/vulnerabilities/44633
https://exchange.xforce.ibmcloud.com/vulnerabilities/44647
https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00555.html