CVE-2004-1034 Buffer overflow in the http_open function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service (application crash) and possibly e...
HighCVSS 10.0
EPSS 5.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the http_open function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media (.ram) playlist file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kaffeine player | = 0.4.2 | No fix listed |
| kaffeine player | = 0.4.3 | No fix listed |
| kaffeine player | = 0.4.3b | No fix listed |
| kaffeine player | = 0.5_rc1 | No fix listed |
| xine gxine | = 0.3 | No fix listed |
| gentoo linux | All versions | No fix listed |
| debian/kaffeine(Debian:12) | < 0.4.3.1-3 | 0.4.3.1-3 |
| debian/kaffeine(Debian:13) | < 0.4.3.1-3 | 0.4.3.1-3 |
| debian/kaffeine(Debian:14) | < 0.4.3.1-3 | 0.4.3.1-3 |
References
- 20041025 Kaffeine Media Player Conteny Type overflow mailing-list
- 13117 third-party-advisory
- GLSA-200411-14 vendor-advisory
- sourceforge.net
- 11528 patch vdb-entry vendor-advisory
- kaffeine-ram-bo(17849) vdb-entry
- Debian Security Tracker CVE-2004-1034 vendor-advisory