CVE-2008-5246 Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22_interp_frame and (2) id3v24_interp_fram...
HighCVSS 9.3
EPSS 5.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22_interp_frame and (2) id3v24_interp_frame functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xine-lib | <= 1.1.14 | No fix listed |
| xine-lib | = 0.9.13 | No fix listed |
| xine-lib | = 1-rc0a | No fix listed |
| xine-lib | = 1-rc1 | No fix listed |
| xine-lib | = 1-rc2 | No fix listed |
| xine-lib | = 1-rc3 | No fix listed |
| xine-lib | = 1-rc3a | No fix listed |
| xine-lib | = 1-rc3b | No fix listed |
| xine-lib | = 1-rc3c | No fix listed |
| xine-lib | = 1-rc4 | No fix listed |
| xine-lib | = 1-rc4a | No fix listed |
| xine-lib | = 1-rc5 | No fix listed |
| xine-lib | = 1-rc6a | No fix listed |
| xine-lib | = 1-rc7 | No fix listed |
| xine-lib | = 1-rc8 | No fix listed |
| xine-lib | = 1.0 | No fix listed |
| xine-lib | = 1.0.1 | No fix listed |
| xine-lib | = 1.0.2 | No fix listed |
| xine-lib | = 1.0.3a | No fix listed |
| xine-lib | = 1.1.0 | No fix listed |
| xine-lib | = 1.1.1 | No fix listed |
| xine-lib | = 1.1.2 | No fix listed |
| xine-lib | = 1.1.3 | No fix listed |
| xine-lib | = 1.1.4 | No fix listed |
| xine-lib | = 1.1.5 | No fix listed |
Show 23 more
| Product | Affected versions | Fixed in |
|---|---|---|
| xine-lib | = 1.1.6 | No fix listed |
| xine-lib | = 1.1.7 | No fix listed |
| xine-lib | = 1.1.8 | No fix listed |
| xine-lib | = 1.1.9 | No fix listed |
| xine-lib | = 1.1.9.1 | No fix listed |
| xine-lib | = 1.1.10 | No fix listed |
| xine-lib | = 1.1.10.1 | No fix listed |
| xine-lib | = 1.1.11 | No fix listed |
| xine-lib | = 1.1.11.1 | No fix listed |
| xine-lib | = 1.1.12 | No fix listed |
| xine-lib | = 1.1.13 | No fix listed |
| xine-lib | = 1_beta1 | No fix listed |
| xine-lib | = 1_beta2 | No fix listed |
| xine-lib | = 1_beta3 | No fix listed |
| xine-lib | = 1_beta4 | No fix listed |
| xine-lib | = 1_beta5 | No fix listed |
| xine-lib | = 1_beta6 | No fix listed |
| xine-lib | = 1_beta7 | No fix listed |
| xine-lib | = 1_beta8 | No fix listed |
| xine-lib | = 1_beta9 | No fix listed |
| xine-lib | = 1_beta10 | No fix listed |
| xine-lib | = 1_beta11 | No fix listed |
| xine-lib | = 1_beta12 | No fix listed |
References
- SUSE-SR:2009:004 vendor-advisory
- 47677 vdb-entry
- 1020703 vdb-entry
- sourceforge.net
- MDVSA-2009:020 vendor-advisory
- 30698 vdb-entry
- ADV-2008-2382 vdb-entry
- xinelib-srcdemuxersid3-bo(44468) vdb-entry
- Debian Security Tracker CVE-2008-5246 vendor-advisory