This script is Copyright (C) 2008-2015 Tenable Network Security, Inc.
The remote Gentoo host is missing one or more security-related
The remote host is affected by the vulnerability described in GLSA-200808-01
(xine-lib: User-assisted execution of arbitrary code)
Multiple vulnerabilities have been discovered in xine-lib:
Alin Rad Pop of Secunia reported an array indexing vulnerability in the
sdpplin_parse() function in the file input/libreal/sdpplin.c when
processing streams from RTSP servers that contain a large 'streamid'
SDP parameter (CVE-2008-0073).
Luigi Auriemma reported multiple integer overflows that result in
heap-based buffer overflows when processing '.FLV', '.MOV' '.RM',
'.MVE', '.MKV', and '.CAK' files (CVE-2008-1482).
Guido Landi reported a stack-based buffer overflow in the
demux_nsf_send_chunk() function when handling titles within NES Music
(.NSF) files (CVE-2008-1878).
A remote attacker could entice a user to play a specially crafted video
file or stream with a player using xine-lib, potentially resulting in
the execution of arbitrary code with the privileges of the user running
There is no known workaround at this time.
See also :
All xine-lib users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=media-libs/xine-lib-1.1.13'
Risk factor :
High / CVSS Base Score : 7.5
CVSS Temporal Score : 6.5
Public Exploit Available : false
Family: Gentoo Local Security Checks
Nessus Plugin ID: 33831 (gentoo_GLSA-200808-01.nasl)
Bugtraq ID: 283122837028816
CVE ID: CVE-2008-0073CVE-2008-1482CVE-2008-1878
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.