| Description: | Summary:
The remote host is missing an update for the Debian 'xine-lib' package(s) announced via the DSA-1536-1 advisory.
Vulnerability Insight:
Several local vulnerabilities have been discovered in Xine, a media player library, allowed for a denial of service or arbitrary code execution, which could be exploited through viewing malicious content. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2007-1246 / CVE-2007-1387 The DMO_VideoDecoder_Open function does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code (applies to sarge only).
CVE-2008-0073
Array index error in the sdpplin_parse function allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.
CVE-2008-0486
Array index vulnerability in libmpdemux/demux_audio.c might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow (applies to etch only).
CVE-2008-1161
Buffer overflow in the Matroska demuxer allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Matroska file with invalid frame sizes.
For the old stable distribution (sarge), these problems have been fixed in version 1.0.1-1sarge7.
For the stable distribution (etch), these problems have been fixed in version 1.1.2+dfsg-6.
For the unstable distribution (sid), these problems have been fixed in version 1.1.11-1.
We recommend that you upgrade your xine-lib package.
Affected Software/OS:
'xine-lib' package(s) on Debian 3.1, Debian 4.
Solution:
Please install the updated package(s).
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
