CVE-2004-1187 Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG....
HighCVSS 10.0
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG values, a different vulnerability than CVE-2004-1188.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mplayer | = 0.90 | No fix listed |
| mplayer | = 0.90_pre | No fix listed |
| mplayer | = 0.90_rc | No fix listed |
| mplayer | = 0.90_rc4 | No fix listed |
| mplayer | = 0.91 | No fix listed |
| mplayer | = 0.92 | No fix listed |
| mplayer | = 0.92.1 | No fix listed |
| mplayer | = 0.92_cvs | No fix listed |
| mplayer | = 1.0_pre1 | No fix listed |
| mplayer | = 1.0_pre2 | No fix listed |
| mplayer | = 1.0_pre3 | No fix listed |
| mplayer | = 1.0_pre3try2 | No fix listed |
| mplayer | = 1.0_pre4 | No fix listed |
| mplayer | = 1.0_pre5 | No fix listed |
| mplayer | = 1.0_pre5try1 | No fix listed |
| mplayer | = 1.0_pre5try2 | No fix listed |
| mplayer | = head_cvs | No fix listed |
| xine | = 0.9.8 | No fix listed |
| xine | = 0.9.13 | No fix listed |
| xine | = 0.9.18 | No fix listed |
| xine | = 1_alpha | No fix listed |
| xine | = 1_beta1 | No fix listed |
| xine | = 1_beta2 | No fix listed |
| xine | = 1_beta3 | No fix listed |
| xine | = 1_beta4 | No fix listed |
Show 51 more
| Product | Affected versions | Fixed in |
|---|---|---|
| xine | = 1_beta5 | No fix listed |
| xine | = 1_beta6 | No fix listed |
| xine | = 1_beta7 | No fix listed |
| xine | = 1_beta8 | No fix listed |
| xine | = 1_beta9 | No fix listed |
| xine | = 1_beta10 | No fix listed |
| xine | = 1_beta11 | No fix listed |
| xine | = 1_beta12 | No fix listed |
| xine | = 1_rc0 | No fix listed |
| xine | = 1_rc0a | No fix listed |
| xine | = 1_rc1 | No fix listed |
| xine | = 1_rc2 | No fix listed |
| xine | = 1_rc3 | No fix listed |
| xine | = 1_rc3a | No fix listed |
| xine | = 1_rc3b | No fix listed |
| xine | = 1_rc4 | No fix listed |
| xine | = 1_rc5 | No fix listed |
| xine | = 1_rc6 | No fix listed |
| xine | = 1_rc6a | No fix listed |
| xine | = 1_rc7 | No fix listed |
| xine | = 1_rc8 | No fix listed |
| xine-lib | = 0.9.8 | No fix listed |
| xine-lib | = 0.9.13 | No fix listed |
| xine-lib | = 0.99 | No fix listed |
| xine-lib | = 1_alpha | No fix listed |
| xine-lib | = 1_beta1 | No fix listed |
| xine-lib | = 1_beta2 | No fix listed |
| xine-lib | = 1_beta3 | No fix listed |
| xine-lib | = 1_beta4 | No fix listed |
| xine-lib | = 1_beta5 | No fix listed |
| xine-lib | = 1_beta6 | No fix listed |
| xine-lib | = 1_beta7 | No fix listed |
| xine-lib | = 1_beta8 | No fix listed |
| xine-lib | = 1_beta9 | No fix listed |
| xine-lib | = 1_beta10 | No fix listed |
| xine-lib | = 1_beta11 | No fix listed |
| xine-lib | = 1_beta12 | No fix listed |
| xine-lib | = 1_rc0 | No fix listed |
| xine-lib | = 1_rc1 | No fix listed |
| xine-lib | = 1_rc2 | No fix listed |
| xine-lib | = 1_rc3 | No fix listed |
| xine-lib | = 1_rc3a | No fix listed |
| xine-lib | = 1_rc3b | No fix listed |
| xine-lib | = 1_rc3c | No fix listed |
| xine-lib | = 1_rc4 | No fix listed |
| xine-lib | = 1_rc5 | No fix listed |
| xine-lib | = 1_rc6 | No fix listed |
| xine-lib | = 1_rc6a | No fix listed |
| xine-lib | = 1_rc7 | No fix listed |
| mandrakesoft mandrake linux | = 10.0 | No fix listed |
| mandrakesoft mandrake linux | = 10.1 | No fix listed |
References
- cvs.sourceforge.net
- 20041221 Multiple Vendor Xine version 0.99.2 PNM Handler PNA_TAG Heap Overflow Vulnerability patch third-party-advisory vendor-advisory
- MDKSA-2005:011 vendor-advisory
- www.mplayerhq.hu
- xine-pnatag-bo(18640) vdb-entry
- Debian Security Tracker CVE-2004-1187 vendor-advisory