CWE
119
Advisory Published
Updated

CVE-2008-5236: Buffer Overflow

First published: Wed Nov 26 2008(Updated: )

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted EBML element length processed by the parse_block_group function in demux_matroska.c; (2) a certain combination of sps, w, and h values processed by the real_parse_audio_specific_data and demux_real_send_chunk functions in demux_real.c; and (3) an unspecified combination of three values processed by the open_ra_file function in demux_realaudio.c. NOTE: vector 2 reportedly exists because of an incomplete fix in 1.1.15.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
xine xine=1-beta3
xine xine=1-rc0a
xine xine=1-beta6
xine xine=1.1.10.1
xine xine=1.0.1
xine xine=1-rc1
xine xine=1-rc6a
xine xine=1-beta4
xine xine=1-rc8
xine xine=1.1.0
xine xine=1-rc5
xine xine=1.1.1
xine xine=1-beta7
xine xine=1.0.3a
xine xine=1.1.3
xine xine=1.0.2
xine xine=1-beta10
xine xine=1-beta1
xine xine=1-rc3a
xine xine=1.0
xine xine=1-beta8
xine xine=1.1.11.1
xine xine<=1.1.5
xine xine=0.9.13
xine xine=1-beta2
xine xine=1-beta9
xine xine=1-rc7
xine xine=1-rc4
xine xine=1.1.11
xine xine=1-rc3c
xine xine=1.1.2
xine xine=1-rc2
xine xine=1-rc4a
xine xine=1-rc3
xine xine=1.1.4
xine xine=1-beta5
xine xine=1-beta11
xine xine=1-beta12
xine xine=1-rc3b

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203