CVE-2008-5234

Common Vulnerabilities and Exposures

Upstream information

CVE-2008-5234 at MITRE

Description

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c. NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15.

NVD CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

Novell/SUSE information

Novell Bugzilla entry: 419541

SUSE Security Advisories:

SUSE-SR:2009:004, published Tue, 17 Feb 2009 10:00:00 +0000

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 10 SP2 for x86	`xine-devel >= 1.1.1-24.43` `xine-lib >= 1.1.1-24.43`	sle10-sp2-sdk.s390x sle10-sp2-sdk.x86 sled10-sp2.x86-64 sle10-sp2-sdk.ppc sle10-sp2-sdk.x86-64 sled10-sp2.x86 sle10-sp2-sdk.ia64 ZYPP Patch Nr: 5965
SUSE Linux Enterprise Desktop 10 SP2 for AMD64 and Intel EM64T	`xine-devel >= 1.1.1-24.43` `xine-lib >= 1.1.1-24.43` `xine-lib-32bit >= 1.1.1-24.43`	sle10-sp2-sdk.s390x sle10-sp2-sdk.x86 sled10-sp2.x86-64 sle10-sp2-sdk.ppc sle10-sp2-sdk.x86-64 sled10-sp2.x86 sle10-sp2-sdk.ia64 ZYPP Patch Nr: 5965
openSUSE 10.3	`xine-devel >= 1.1.8-14.11` `xine-extra >= 1.1.8-14.11` `xine-lib >= 1.1.8-14.11` `xine-lib-32bit >= 1.1.8-14.11` `xine-lib-64bit >= 1.1.8-14.11`
Novell Linux Desktop 9 for x86	`xine-lib >= 0.99.rc3a-106.49`	sles9-nld.x86-64 core9.x86-64 core9.s390 sles9-nld.x86 core9.x86 sles9-nld.x86 sles9-nld.x86-64 core9.ppc core9.s390x core9.ia64 YOU Patch Nr: 12346
Novell Linux Desktop 9 for x86_64	`xine-lib >= 0.99.rc3a-106.49` `xine-lib-32bit >= 9-200901281640`	sles9-nld.x86-64 core9.x86-64 core9.s390 sles9-nld.x86 core9.x86 sles9-nld.x86 sles9-nld.x86-64 core9.ppc core9.s390x core9.ia64 YOU Patch Nr: 12346
SLES SDK 9 for IPF	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-lib-x86 >= 9-200901281640` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld.x86-64 core9.x86-64 core9.s390 sles9-nld.x86 core9.x86 sles9-nld.x86 sles9-nld.x86-64 core9.ppc core9.s390x core9.ia64 YOU Patch Nr: 12346
SLES SDK 9 for IBM iSeries and IBM pSeries	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-lib-64bit >= 9-200901281643` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld.x86-64 core9.x86-64 core9.s390 sles9-nld.x86 core9.x86 sles9-nld.x86 sles9-nld.x86-64 core9.ppc core9.s390x core9.ia64 YOU Patch Nr: 12346
Novell Linux Desktop 9 SDK for x86 SLES SDK 9 for IBM S/390 and IBM zSeries SLES SDK 9 for x86	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld.x86-64 core9.x86-64 core9.s390 sles9-nld.x86 core9.x86 sles9-nld.x86 sles9-nld.x86-64 core9.ppc core9.s390x core9.ia64 YOU Patch Nr: 12346
SLES SDK 9 for IBM zSeries	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-lib-32bit >= 9-200901281627` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld.x86-64 core9.x86-64 core9.s390 sles9-nld.x86 core9.x86 sles9-nld.x86 sles9-nld.x86-64 core9.ppc core9.s390x core9.ia64 YOU Patch Nr: 12346
Novell Linux Desktop 9 SDK for x86_64 SLES SDK 9 for X86-64	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-lib-32bit >= 9-200901281640` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld.x86-64 core9.x86-64 core9.s390 sles9-nld.x86 core9.x86 sles9-nld.x86 sles9-nld.x86-64 core9.ppc core9.s390x core9.ia64 YOU Patch Nr: 12346

Markets

Products By Category

Novell

NetIQ (Moving soon to NetIQ.com)

A-Z

Contribute