Mandrake Linux Security Advisory : xine-lib (MDKSA-2004:105)
High Nessus Plugin ID 15434
SynopsisThe remote Mandrake Linux host is missing one or more security updates.
DescriptionA number of string overflows were discovered in the xine-lib program, some of which can be used for remote buffer overflow exploits that lead to the execution of arbitrary code with the permissions of the user running a xine-lib-based media application. xine-lib versions 1-rc2 through, and including, 1-rc5 are vulnerable to these problems.
As well, a heap overflow was found in the DVD subpicture decoder of xine-lib; this vulnerability is also remotely exploitable. All versions of xine-lib prior to and including 0.5.2 through, and including, 1-rc5 are vulnerable to this problem.
Patches from the xine-lib team have been backported and applied to the program to solve these problems.
SolutionUpdate the affected packages.