Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385.

Specially crafted 4x movie files could cause an integer overflow in xine-lib. (CVE-2009-0698)

The remote host is affected by the vulnerability described in GLSA-201006-04 (xine-lib: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been reported in xine-lib. Please review     the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to play a specially crafted video     file or stream with a player using xine-lib, potentially resulting in     the execution of arbitrary code with the privileges of the user running     the application.
  Workaround :

    There is no known workaround at this time.

Vulnerabilities have been discovered and corrected in xine-lib :

Failure on Ogg files manipulation can lead remote attackers to cause a denial of service by using crafted files (CVE-2008-3231).

Failure on manipulation of either MNG or Real or MOD files can lead remote attackers to cause a denial of service by using crafted files (CVE: CVE-2008-5233).

Heap-based overflow allows remote attackers to execute arbitrary code by using Quicktime media files holding crafted metadata (CVE-2008-5234).

Heap-based overflow allows remote attackers to execute arbitrary code by using either crafted Matroska or Real media files (CVE-2008-5236).

Failure on manipulation of either MNG or Quicktime files can lead remote attackers to cause a denial of service by using crafted files (CVE-2008-5237).

Multiple heap-based overflow on input plugins (http, net, smb, dvd, dvb, rtsp, rtp, pvr, pnm, file, gnome_vfs, mms) allow attackers to execute arbitrary code by handling that input channels. Further this problem can even lead attackers to cause denial of service (CVE-2008-5239).

Heap-based overflow allows attackers to execute arbitrary code by using crafted Matroska media files (MATROSKA_ID_TR_CODECPRIVATE track entry element). Further a failure on handling of Real media files (CONT_TAG header) can lead to a denial of service attack (CVE-2008-5240).

Integer underflow allows remote attackers to cause denial of service by using Quicktime media files (CVE-2008-5241).

Failure on manipulation of Real media files can lead remote attackers to cause a denial of service by indexing an allocated buffer with a certain input value in a crafted file (CVE-2008-5243).

Vulnerabilities of unknown impact - possibly buffer overflow - caused by a condition of video frame preallocation before ascertaining the required length in V4L video input plugin (CVE-2008-5245).

Heap-based overflow allows remote attackers to execute arbitrary code by using crafted media files. This vulnerability is in the manipulation of ID3 audio file data tagging mainly used in MP3 file formats (CVE-2008-5246).

Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow (CVE-2009-1274)

Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385 (CVE-2009-0698)

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update fixes these issues.

Vulnerabilities have been discovered and corrected in xine-lib :

  - Integer overflow in the qt_error parse_trak_atom     function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and     earlier allows remote attackers to execute arbitrary     code via a Quicktime movie file with a large count value     in an STTS atom, which triggers a heap-based buffer     overflow (CVE-2009-1274)

  - Integer overflow in the 4xm demuxer     (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows     remote attackers to cause a denial of service (crash)     and possibly execute arbitrary code via a 4X movie file     with a large current_track value, a similar issue to     CVE-2009-0385 (CVE-2009-0698)

This update fixes these issues.

Specially crafted 4x movie files could cause an integer overflow in xine-lib (CVE-2009-0698).

Multiple vulnerabilities were fixed in libxine 1.1.16.2.

Tobias Klein reports :

FFmpeg contains a type conversion vulnerability while parsing malformed 4X movie files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of FFmpeg or an application using the FFmpeg library.

Note: A similar issue also affects xine-lib < version 1.1.16.2.

xine developers report :

- Fix broken size checks in various input plugins (ref.
CVE-2008-5239).

- More malloc checking (ref. CVE-2008-5240).

It was discovered that the 4xm demuxer in xine-lib did not correctly handle a large current_track value in a 4xm file, resulting in an integer overflow. If a user or automated system were tricked into opening a specially crafted 4xm movie file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0698)

USN-710-1 provided updated xine-lib packages to fix multiple security vulnerabilities. The security patch to fix CVE-2008-5239 introduced a regression causing some media files to be unplayable. This update corrects the problem. We apologize for the inconvenience.

It was discovered that the input handlers in xine-lib did not correctly handle certain error codes, resulting in out-of-bounds reads and heap- based buffer overflows. If a user or automated system were tricked into opening a specially crafted file, stream, or URL, an attacker could execute arbitrary code as the user invoking the program. (CVE-2008-5239).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the QT demuxer in xine-lib did not correctly handle a large count value in an STTS atom, resulting in a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted MOV file, an attacker could execute arbitrary code as the user invoking the program. (CVE-2009-1274)

USN-746-1 provided updated xine-lib packages to fix multiple security vulnerabilities. The security patch to fix CVE-2009-0698 was incomplete. This update corrects the problem.

It was discovered that the 4xm demuxer in xine-lib did not correctly handle a large current_track value in a 4xm file, resulting in an integer overflow. If a user or automated system were tricked into opening a specially crafted 4xm movie file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0698).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
51769	SuSE 10 Security Update : Xine (ZYPP Patch Number 6050)	Nessus	SuSE Local Security Checks	high
46771	GLSA-201006-04 : xine-lib: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
43022	Mandriva Linux Security Advisory : xine-lib (MDVSA-2009:319)	Nessus	Mandriva Local Security Checks	critical
42810	Mandriva Linux Security Advisory : xine-lib (MDVSA-2009:299)	Nessus	Mandriva Local Security Checks	high
41434	SuSE 11 Security Update : Xine (SAT Patch Number 643)	Nessus	SuSE Local Security Checks	high
40274	openSUSE Security Update : libxine-devel (libxine-devel-582)	Nessus	SuSE Local Security Checks	high
40055	openSUSE Security Update : libxine-devel (libxine-devel-582)	Nessus	SuSE Local Security Checks	high
38803	FreeBSD : libxine -- multiple vulnerabilities (51d1d428-42f0-11de-ad22-000e35248ad7)	Nessus	FreeBSD Local Security Checks	high
37983	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : xine-lib vulnerability (USN-746-1)	Nessus	Ubuntu Local Security Checks	high
37806	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 : xine-lib vulnerabilities (USN-763-1)	Nessus	Ubuntu Local Security Checks	high
36203	openSUSE 10 Security Update : libxine-devel (libxine-devel-6052)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2009-0698

critical

Tenable Plugins

high

critical

critical

high

high

high

high

high

high

high

high