FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-5234

This CVE name corresponds to:

Entered	Topic
2009-05-17	libxine -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-5234 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-5234
Phase	Assigned(20081125)

Description

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c. NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15.

References

Source	Reference
BUGTRAQ	20080822 [oCERT-2008-008] multiple heap overflows in xine-lib
MISC	http://www.ocert.org/analysis/2008-008/analysis.txt
CONFIRM	http://sourceforge.net/project/shownotes.php?release_id=619869
FEDORA	FEDORA-2009-0542
FEDORA	FEDORA-2008-7512
FEDORA	FEDORA-2008-7572
MANDRIVA	MDVSA-2009:020
SUSE	SUSE-SR:2009:004
BID	30797
SECUNIA	31827
VUPEN	ADV-2008-2382
SECTRACK	1020703
SECUNIA	31502
SECUNIA	33544
SREASON	4648
XF	xinelib-id3v23interpframe-bo(44647)
XF	xinelib-parsemoovatom-bo(44633)