Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) crafted width and height values that are not validated by the mymngprocessheader function in demuxmng.c before use in an allocation calculation or (2) crafted currentatomsize and stringsize values processed by the parsereferenceatom function in demuxqt.c for an RDRFATOM string.

Heap-based buffer overflow in the demuxrealsendchunk function in src/demuxers/demuxreal.c in xine-lib before 1.1.15 allows remote attackers to execute arbitrary code via a crafted Real Media file. NOTE: some of these details are obtained from third party information.

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted EBML element length processed by the parseblockgroup function in demuxmatroska.c; (2) a certain combination of sps, w, and h values processed by the realparseaudiospecificdata and demuxrealsendchunk functions in demuxreal.c; and (3) an unspecified combination of three values processed by the openrafile function in demuxrealaudio.c. NOTE: vector 2 reportedly exists because of an incomplete fix in 1.1.15.

Integer overflow in the realparsemdpr function in demuxreal.c in xine-lib 1.1.12, and other versions before 1.1.15, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted streamnamesize field.