FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-1274

This CVE name corresponds to:

Entered	Topic
2009-05-17	libxine -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-1274 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-1274
Phase	Assigned(20090408)

Description

Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow.

References

Source	Reference
BUGTRAQ	20090404 [TKADV2009-005] xine-lib Quicktime STTS Atom Integer Overflow
MISC	http://www.trapkit.de/advisories/TKADV2009-005.txt
CONFIRM	http://bugs.xine-project.org/show_bug.cgi?id=224
CONFIRM	http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=673233
FEDORA	FEDORA-2009-3428
FEDORA	FEDORA-2009-3433
MANDRIVA	MDVSA-2009:298
MANDRIVA	MDVSA-2009:299
SUSE	SUSE-SR:2009:011
BID	34384
OSVDB	53288
SECTRACK	1021989
SECUNIA	34593
SECUNIA	34712
SECUNIA	35416
VUPEN	ADV-2009-0937
XF	xinelib-demuxqt-bo(49714)