INFORMATION BULLETIN
INFORMATION BULLETIN
| PROBLEM: | Several local vulnerabilities have been discovered in Xine, a media player library, allowed for a denial of service or arbitrary code execution, which could be exploited through viewing malicious content. |
| PLATFORM: | Debian GNU/Linux 3.1 (sarge), 4.0 (etch) and (stable) |
| DAMAGE: | DoS or arbitrary code execution. |
| SOLUTION: | Upgrade to the appropriate version. |
| VULNERABILITY ASSESSMENT: |
The risk is MEDIUM. Allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code. |
| CVSS 2 BASE SCORE: TEMPORAL SCORE: VECTOR: |
5.8 4.5 (AV:N/AC:M/Au:N/C:P/I:P/A:N/E:POC/RL:OF/RC:C) |
| LINKS: | |
| CIAC BULLETIN: | http://www.ciac.org/ciac/bulletins/s-261.shtml |
| ORIGINAL BULLETIN: | http://www.debian.org/security/2008/dsa-1536 |
| ADDITIONAL LINK: | http://www.debian.org/security/2008/dsa-1543 |
| CVE: | CVE-2007-1246 CVE-2007-1387 CVE-2008-0073 CVE-2008-1161 |
REVISION HISTORY:
04/14/2008 - revised S-261 to add a link to Debian Security Advisory DSA-1543-1 for
Debian GNU/Linux 4.0 (stable).
[***** Start Debian Security Advisory DSA-1536-1 *****]
Several local vulnerabilities have been discovered in Xine, a media player library, allowed for a denial of service or arbitrary code execution, which could be exploited through viewing malicious content. The Common Vulnerabilities and Exposures project identifies the following problems:
The DMO_VideoDecoder_Open function does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code (applies to sarge only).
Array index error in the sdpplin_parse function allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.
Array index vulnerability in libmpdemux/demux_audio.c might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow (applies to etch only).
Buffer overflow in the Matroska demuxer allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Matroska file with invalid frame sizes.
For the old stable distribution (sarge), these problems have been fixed in version 1.0.1-1sarge7.
For the stable distribution (etch), these problems have been fixed in version 1.1.2+dfsg-6.
For the unstable distribution (sid), these problems have been fixed in version 1.1.11-1.
We recommend that you upgrade your xine-lib package.
MD5 checksums of the listed files are available in the original advisory.
[***** End Debian Security Advisory DSA-1536-1 *****]
Voice: +1 925-422-8193 (7 x 24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org