Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) crafted width and height values that are not validated by the mymngprocessheader function in demuxmng.c before use in an allocation calculation or (2) crafted currentatomsize and stringsize values processed by the parsereferenceatom function in demuxqt.c for an RDRFATOM string.
Unspecified vulnerability in xine-lib before 1.1.15 has unknown impact and attack vectors related to libfaad. NOTE: due to the lack of details, it is not clear whether this is an issue in xine-lib or in libfaad.
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parsemoovatom function in demuxqt.c and (2) frame reading in the id3v23interpframe function in id3.c. NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15.
xine-lib before 1.1.15 performs V4L video frame preallocation before ascertaining the required length, which has unknown impact and attack vectors, possibly related to a buffer overflow in the openvideocapturedevice function in src/input/inputv4l.c.
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted EBML element length processed by the parseblockgroup function in demuxmatroska.c; (2) a certain combination of sps, w, and h values processed by the realparseaudiospecificdata and demuxrealsendchunk functions in demuxreal.c; and (3) an unspecified combination of three values processed by the openrafile function in demuxrealaudio.c. NOTE: vector 2 reportedly exists because of an incomplete fix in 1.1.15.
Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22interpframe and (2) id3v24interpframe functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
demuxqt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not validate the count field before calling calloc for STSDATOM atom allocation, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.
xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via a crafted OGG file, as demonstrated by playing lol-ffplay.ogg with xine.
The realparseheaders function in demuxreal.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input length value to "reindex into an allocated buffer," which allows remote attackers to cause a denial of service (crash) via a crafted value, probably an array index error.
The realparseaudiospecificdata function in demuxreal.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, uses an untrusted height (aka codecdatalength) value as a divisor, which allow remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero value.
xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via "MP3 files with metadata consisting only of separators."
xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the memory allocation and does not check the result for (1) the MATROSKAIDTRCODECPRIVATE track entry element processed by demuxmatroska.c; and (2) PROPTAG, (3) MDPRTAG, and (4) CONTTAG chunks processed by the realparseheaders function in demuxreal.c; which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) or possibly execute arbitrary code via a crafted value.
xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not properly handle (a) negative and (b) zero values during unspecified read function calls in inputfile.c, inputnet.c, inputsmb.c, and inputhttp.c, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors such as (1) a file or (2) an HTTP response, which triggers consequences such as out-of-bounds reads and heap-based buffer overflows.
xine-lib 1.1.12, and other versions before 1.1.15, does not check for failure of malloc in circumstances including (1) the mymngprocessheader function in demuxmng.c, (2) the openmodfile function in demuxmod.c, and (3) framebuffer allocation in the realparseaudiospecificdata function in demuxreal.c, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.
Integer underflow in demuxqt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allows remote attackers to cause a denial of service (crash) via a crafted media file that results in a small value of moovatomsize in a compressed MOV (aka CMOVATOM).