| Description: | Summary:
The remote host is missing an update for the 'xine-lib' package(s) announced via the SSA:2008-111-01 advisory.
Vulnerability Insight:
New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0,
12.0, and -current to fix security issues.
An overflow was found in the Speex decoder that could lead to a crash or
possible execution of arbitrary code.
Xine-lib <= 1.1.12 was also found to be vulnerable to a stack-based buffer
overflow in the NES demuxer (thanks to milw0rm.com).
More details about the first issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:
[link moved to references]
Here are the details from the Slackware 12.0 ChangeLog:
+--------------------------+
patches/packages/xine-lib-1.1.11.1-i686-3_slack12.0.tgz:
Recompiled, with --without-speex (we didn't ship the speex library in
Slackware anyway, but for reference this issue would be CVE-2008-1686),
and with --disable-nosefart (the recently reported as insecurely
demuxed NSF format). As before in -2, this package fixes the two
regressions mentioned in the release notes for xine-lib-1.1.12:
[link moved to references]
(* Security fix *)
+--------------------------+
Affected Software/OS:
'xine-lib' package(s) on Slackware 10.0, Slackware 10.1, Slackware 10.2, Slackware 11.0, Slackware 12.0, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
