Executive Summary

Summary
Title New xine-lib packages fix denial of service
Informations
Name DSA-1105 First vendor Publication 2006-07-07
Vendor Debian Last vendor Modification 2006-07-07
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Federico L. Bossi Bonin discovered a buffer overflow in the HTTP Plugin in xine-lib, the xine video/media player library, taht could allow a remote attacker to cause a denial of service.

For the old stable distribution (woody) this problem has been fixed in version 0.9.8-2woody5.

For the stable distribution (sarge) this problem has been fixed in version 1.0.1-1sarge3.

For the unstable distribution (sid) this problem has been fixed in version 1.1.1-2.

We recommend that you upgrade your libxine packages.

Original Source

Url : http://www.debian.org/security/2006/dsa-1105

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 4

OpenVAS Exploits

Date Description
2008-09-24 Name : Gentoo Security Advisory GLSA 200609-08 (xine-lib)
File : nvt/glsa_200609_08.nasl
2008-09-04 Name : FreeBSD Ports: libxine
File : nvt/freebsd_libxine4.nasl
2008-01-17 Name : Debian Security Advisory DSA 1105-1 (xine-lib)
File : nvt/deb_1105_1.nasl
0000-00-00 Name : Slackware Advisory SSA:2006-207-04 xine-lib
File : nvt/esoft_slk_ssa_2006_207_04.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
25936 xine-lib xineplug_inp_http.so HTTP Response Remote Overflow

A remote overflow exists in xine-lib. The xineplug_inp_http.so library fails to properly check bounds for HTTP responses resulting in a buffer overflow. By tricking a victim into opening an HTTP link to a malicious website, an attacker can cause arbitary code execution on the victim\'s system resulting in a loss of integrity.

Nessus® Vulnerability Scanner

Date Description
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-295-1.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_xine-lib-1599.nasl - Type : ACT_GATHER_INFO
2007-02-18 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2006-173.nasl - Type : ACT_GATHER_INFO
2007-02-18 Name : The remote Mandrake Linux host is missing a security update.
File : mandrake_MDKSA-2006-174.nasl - Type : ACT_GATHER_INFO
2007-02-18 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2006-175.nasl - Type : ACT_GATHER_INFO
2007-02-18 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2006-176.nasl - Type : ACT_GATHER_INFO
2006-10-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1105.nasl - Type : ACT_GATHER_INFO
2006-09-15 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200609-08.nasl - Type : ACT_GATHER_INFO
2006-07-28 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2006-207-04.nasl - Type : ACT_GATHER_INFO
2006-06-24 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2006-108.nasl - Type : ACT_GATHER_INFO
2006-06-16 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_107e2ee5f94111dab1fa020039488e34.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:25:57
  • Multiple Updates