Ubuntu Security Notice (C) 2009-2016 Canonical, Inc. / NASL script (C) 2009-2016 Tenable Network Security, Inc.
The remote Ubuntu host is missing one or more security-related
It was discovered that the QT demuxer in xine-lib did not correctly
handle a large count value in an STTS atom, resulting in a heap-based
buffer overflow. If a user or automated system were tricked into
opening a specially crafted MOV file, an attacker could execute
arbitrary code as the user invoking the program. (CVE-2009-1274)
USN-746-1 provided updated xine-lib packages to fix multiple security
vulnerabilities. The security patch to fix CVE-2009-0698 was
incomplete. This update corrects the problem.
It was discovered that the 4xm demuxer in xine-lib did not correctly
handle a large current_track value in a 4xm file, resulting in an
integer overflow. If a user or automated system were tricked into
opening a specially crafted 4xm movie file, an attacker could crash
xine-lib or possibly execute arbitrary code with the privileges of the
user invoking the program. (CVE-2009-0698).
Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.
Update the affected packages.
Risk factor :
High / CVSS Base Score : 7.5
CVSS Temporal Score : 6.5
Public Exploit Available : false