CVE-2008-5259 Integer signedness error in DivX Web Player 1.4.2.7, and possibly earlier versions, allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format (STRF) chunk, w...
HighCVSS 9.3
EPSS 5.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer signedness error in DivX Web Player 1.4.2.7, and possibly earlier versions, allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format (STRF) chunk, which triggers a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| divx web player | <= 1.4.2.7 | No fix listed |
| divx web player | = 1.0.1 | No fix listed |
| divx web player | = 1.0.2 | No fix listed |
| divx web player | = 1.1 | No fix listed |
| divx web player | = 1.1.0 | No fix listed |
| divx web player | = 1.2 | No fix listed |
| divx web player | = 1.2.0 | No fix listed |
| divx web player | = 1.3 | No fix listed |
| divx web player | = 1.3.0 | No fix listed |
| divx web player | = 1.3.1 | No fix listed |
| divx web player | = 1.4 | No fix listed |
| divx web player | = 1.4.0-beta2 | No fix listed |
| divx web player | = 1.4.1-beta1 | No fix listed |
| divx web player | = 1.4.2-beta2 | No fix listed |
References
- 33196 third-party-advisory vendor-advisory
- secunia.com vendor-advisory
- 20090415 Secunia Research: DivX Web Player Stream Format Chunk Buffer Overflow mailing-list
- 34523 vdb-entry
- 1022061 vdb-entry
- ADV-2009-1044 vdb-entry vendor-advisory
- divxwebplayer-strf-bo(49908) vdb-entry