Executive Summary
Summary | |
---|---|
Title | xine-lib vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-763-1 | First vendor Publication | 2009-04-20 |
Vendor | Ubuntu | Last vendor Modification | 2009-04-20 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 8.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: Ubuntu 8.04 LTS: Ubuntu 8.10: After a standard system upgrade you need to restart applications linked against xine-lib, such as Totem-xine and Amarok, to effect the necessary changes. Details follow: It was discovered that the QT demuxer in xine-lib did not correctly handle a large count value in an STTS atom, resulting in a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted MOV file, an attacker could execute arbitrary code as the user invoking the program. (CVE-2009-1274) USN-746-1 provided updated xine-lib packages to fix multiple security vulnerabilities. The security patch to fix CVE-2009-0698 was incomplete. This update corrects the problem. Original advisory details: |
Original Source
Url : http://www.ubuntu.com/usn/USN-763-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
50 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:13445 | |||
Oval ID: | oval:org.mitre.oval:def:13445 | ||
Title: | USN-763-1 -- xine-lib vulnerabilities | ||
Description: | It was discovered that the QT demuxer in xine-lib did not correctly handle a large count value in an STTS atom, resulting in a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted MOV file, an attacker could execute arbitrary code as the user invoking the program. USN-746-1 provided updated xine-lib packages to fix multiple security vulnerabilities. The security patch to fix CVE-2009-0698 was incomplete. This update corrects the problem. Original advisory details: It was discovered that the 4xm demuxer in xine-lib did not correctly handle a large current_track value in a 4xm file, resulting in an integer overflow. If a user or automated system were tricked into opening a specially crafted 4xm movie file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program | ||
Family: | unix | Class: | patch |
Reference(s): | USN-763-1 CVE-2009-1274 CVE-2009-0698 | Version: | 5 |
Platform(s): | Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 | Product(s): | xine-lib |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2011-03-09 | Name : Gentoo Security Advisory GLSA 201006-04 (xine-lib) File : nvt/glsa_201006_04.nasl |
2009-12-10 | Name : Mandriva Security Advisory MDVSA-2009:319 (xine-lib) File : nvt/mdksa_2009_319.nasl |
2009-11-17 | Name : Mandriva Security Advisory MDVSA-2009:298 (xine-lib) File : nvt/mdksa_2009_298.nasl |
2009-11-17 | Name : Mandriva Security Advisory MDVSA-2009:299 (xine-lib) File : nvt/mdksa_2009_299.nasl |
2009-06-15 | Name : SuSE Security Summary SUSE-SR:2009:011 File : nvt/suse_sr_2009_011.nasl |
2009-06-05 | Name : Ubuntu USN-743-1 (gs-gpl) File : nvt/ubuntu_743_1.nasl |
2009-06-05 | Name : Ubuntu USN-744-1 (lcms) File : nvt/ubuntu_744_1.nasl |
2009-06-05 | Name : Ubuntu USN-763-1 (xine-lib) File : nvt/ubuntu_763_1.nasl |
2009-05-20 | Name : FreeBSD Ports: libxine File : nvt/freebsd_libxine11.nasl |
2009-05-20 | Name : FreeBSD Ports: libxine File : nvt/freebsd_libxine12.nasl |
2009-04-28 | Name : SuSE Security Summary SUSE-SR:2009:009 File : nvt/suse_sr_2009_009.nasl |
2009-04-15 | Name : Fedora Core 9 FEDORA-2009-3428 (xine-lib) File : nvt/fcore_2009_3428.nasl |
2009-04-15 | Name : Fedora Core 10 FEDORA-2009-3433 (xine-lib) File : nvt/fcore_2009_3433.nasl |
2009-04-06 | Name : Ubuntu USN-746-1 (xine-lib) File : nvt/ubuntu_746_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
53288 | xine-lib STTS Quicktime Atom Handling Remote Overflow |
52498 | xine-lib demuxers/demux_4xm.c current_track Value Handling Overflow |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_xine-devel-6050.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_xine-devel-6229.nasl - Type : ACT_GATHER_INFO |
2010-06-02 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201006-04.nasl - Type : ACT_GATHER_INFO |
2009-12-07 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-319.nasl - Type : ACT_GATHER_INFO |
2009-11-16 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-299.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libxine-devel-090318.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_libxine1-090507.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_libxine-devel-090309.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_xine-devel-090507.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_libxine-devel-090309.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_libxine1-090507.nasl - Type : ACT_GATHER_INFO |
2009-05-20 | Name : The remote openSUSE host is missing a security update. File : suse_xine-devel-6230.nasl - Type : ACT_GATHER_INFO |
2009-05-18 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_48e14d8642f111dead22000e35248ad7.nasl - Type : ACT_GATHER_INFO |
2009-05-18 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_51d1d42842f011dead22000e35248ad7.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-763-1.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-746-1.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3433.nasl - Type : ACT_GATHER_INFO |
2009-04-21 | Name : The remote openSUSE host is missing a security update. File : suse_libxine-devel-6052.nasl - Type : ACT_GATHER_INFO |
2009-04-10 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3428.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 12:05:54 |
|