CVE-2008-5236: Buffer Overflow
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted EBML element length processed by the parseblockgroup function in demuxmatroska.c; (2) a certain combination of sps, w, and h values processed by the realparseaudiospecificdata and demuxrealsendchunk functions in demuxreal.c; and (3) an unspecified combination of three values processed by the openrafile function in demuxrealaudio.c. NOTE: vector 2 reportedly exists because of an incomplete fix in 1.1.15.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5236?
CVE-2008-5236 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2008-5236?
To fix CVE-2008-5236, update xine-lib to version 1.1.15 or later.
What types of attacks can exploit CVE-2008-5236?
CVE-2008-5236 can be exploited by remote attackers through crafted input files that trigger heap-based buffer overflows.
What versions of xine-lib are affected by CVE-2008-5236?
CVE-2008-5236 affects xine-lib versions 1.1.12 and earlier, including various beta and release candidates.
What is the impact of exploiting CVE-2008-5236?
Exploiting CVE-2008-5236 can allow attackers to execute arbitrary code on the affected system.