MDVSA-2009:298
- Package name
- xine-lib
- Date
- 2009-11-13
- Advisory ID
- MDVSA-2009:298
- Affected versions
- CS3.0 i586 , CS3.0 x86_64
Problem description
Vulnerabilities have been discovered and corrected in xine-lib:
- xine-lib before 1.1.15 allows remote attackers to cause a denial
of service (crash) via mp3 files with metadata consisting only of
separators (CVE-2008-5248)
- Integer overflow in the qt_error parse_trak_atom function in
demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote
attackers to execute arbitrary code via a Quicktime movie file with a
large count value in an STTS atom, which triggers a heap-based buffer
overflow (CVE-2009-1274)
- Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c)
in xine-lib 1.1.16.1 allows remote attackers to cause a denial of
service (crash) and possibly execute arbitrary code via a 4X movie
file with a large current_track value, a similar issue to CVE-2009-0385
(CVE-2009-0698)
This update fixes these issues.
Updated packages
CS3.0 i586
47002044e449dde281941081839c6fa9 corporate/3.0/i586/libxine1-1-0.rc3.6.18.C30mdk.i586.rpm 0abdd642e1014e67f83445818c69d666 corporate/3.0/i586/libxine1-devel-1-0.rc3.6.18.C30mdk.i586.rpm 2190418670c91e44a8b48fe1c29afaa5 corporate/3.0/i586/xine-aa-1-0.rc3.6.18.C30mdk.i586.rpm 95a464b49a559cbc57eee48ae37224b9 corporate/3.0/i586/xine-arts-1-0.rc3.6.18.C30mdk.i586.rpm e95764e9cec627b27b416e001e7e7482 corporate/3.0/i586/xine-dxr3-1-0.rc3.6.18.C30mdk.i586.rpm 8829d42bc844675045b6153fe36021f1 corporate/3.0/i586/xine-esd-1-0.rc3.6.18.C30mdk.i586.rpm 7c5d8aea1c07df147cb4ae9b9a0c5464 corporate/3.0/i586/xine-flac-1-0.rc3.6.18.C30mdk.i586.rpm 136374c1cf768fd20bd16384a43d2677 corporate/3.0/i586/xine-gnomevfs-1-0.rc3.6.18.C30mdk.i586.rpm 0566b33424cf000e5c708fa3b4114f03 corporate/3.0/i586/xine-plugins-1-0.rc3.6.18.C30mdk.i586.rpm 2a3fd8d1416bcdb149ae0176b024894d corporate/3.0/SRPMS/xine-lib-1-0.rc3.6.18.C30mdk.src.rpm
CS3.0 x86_64
5bae0dd040512b8ca9192623241e25ff corporate/3.0/x86_64/lib64xine1-1-0.rc3.6.18.C30mdk.x86_64.rpm 5c7e07610511ae684a31ce859c8ebcf6 corporate/3.0/x86_64/lib64xine1-devel-1-0.rc3.6.18.C30mdk.x86_64.rpm f7431390bbd6b04bd7e1c6d684c033e1 corporate/3.0/x86_64/xine-aa-1-0.rc3.6.18.C30mdk.x86_64.rpm 094905da7c51e1d15d9af52735a8b8e1 corporate/3.0/x86_64/xine-arts-1-0.rc3.6.18.C30mdk.x86_64.rpm 5490e9cc4ca21c0f00dbe1d097f00232 corporate/3.0/x86_64/xine-esd-1-0.rc3.6.18.C30mdk.x86_64.rpm e144fea85dcfc1749dff42824c66eb40 corporate/3.0/x86_64/xine-flac-1-0.rc3.6.18.C30mdk.x86_64.rpm 276d7b3f1d16c3bb730124b483edcc40 corporate/3.0/x86_64/xine-gnomevfs-1-0.rc3.6.18.C30mdk.x86_64.rpm a638804b41ab4fec8bb16118da7e19fe corporate/3.0/x86_64/xine-plugins-1-0.rc3.6.18.C30mdk.x86_64.rpm 2a3fd8d1416bcdb149ae0176b024894d corporate/3.0/SRPMS/xine-lib-1-0.rc3.6.18.C30mdk.src.rpm