CVE-2008-5242

Common Vulnerabilities and Exposures

CVE-2008-5242 at MITRE

Details

demux_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not validate the count field before calling calloc for STSD_ATOM atom allocation, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.

Novell Bugzilla entry: 419541

SUSE Security Advisories:

SUSE-SR:2009:004, published Tue, 17 Feb 2009 10:00:00 +0000
SUSE-SR:2009:004 , published Tue, 17 Feb 2009 10:00:00 +0000

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 10 SP2 for x86	`xine-devel >= 1.1.1-24.43` `xine-lib >= 1.1.1-24.43`	sles10-sp2-sdk. s390x sles10-sp2-sdk. x86 sled10-sp2. x86-64 sles10-sp2-sdk. ppc sles10-sp2-sdk. x86-64 sled10-sp2. x86 sles10-sp2-sdk. ia64 ZYPP Patch Nr: 5965
SUSE Linux Enterprise Desktop 10 SP2 for AMD64 and Intel EM64T	`xine-devel >= 1.1.1-24.43` `xine-lib >= 1.1.1-24.43` `xine-lib-32bit >= 1.1.1-24.43`	sles10-sp2-sdk. s390x sles10-sp2-sdk. x86 sled10-sp2. x86-64 sles10-sp2-sdk. ppc sles10-sp2-sdk. x86-64 sled10-sp2. x86 sles10-sp2-sdk. ia64 ZYPP Patch Nr: 5965
SLE SDK 10 SP2 for x86	`xine-devel >= 1.1.1-24.43` `xine-extra >= 1.1.1-24.43` `xine-lib >= 1.1.1-24.43` `xine-ui >= 0.99.4-32.39`	sles10-sp2-sdk. s390x sles10-sp2-sdk. x86 sled10-sp2. x86-64 sles10-sp2-sdk. ppc sles10-sp2-sdk. x86-64 sled10-sp2. x86 sles10-sp2-sdk. ia64 ZYPP Patch Nr: 5965
SLE SDK 10 SP2 for IPF	`xine-devel >= 1.1.1-24.43` `xine-extra >= 1.1.1-24.43` `xine-lib >= 1.1.1-24.43` `xine-lib-x86 >= 1.1.1-24.43` `xine-ui >= 0.99.4-32.39`	sles10-sp2-sdk. s390x sles10-sp2-sdk. x86 sled10-sp2. x86-64 sles10-sp2-sdk. ppc sles10-sp2-sdk. x86-64 sled10-sp2. x86 sles10-sp2-sdk. ia64 ZYPP Patch Nr: 5965
SLE SDK 10 SP2 for IBM iSeries and IBM pSeries	`xine-devel >= 1.1.1-24.43` `xine-extra >= 1.1.1-24.43` `xine-lib >= 1.1.1-24.43` `xine-lib-64bit >= 1.1.1-24.43` `xine-ui >= 0.99.4-32.39`	sles10-sp2-sdk. s390x sles10-sp2-sdk. x86 sled10-sp2. x86-64 sles10-sp2-sdk. ppc sles10-sp2-sdk. x86-64 sled10-sp2. x86 sles10-sp2-sdk. ia64 ZYPP Patch Nr: 5965
SLE SDK 10 SP2 for IBM zSeries SLE SDK 10 SP2 for X86-64	`xine-devel >= 1.1.1-24.43` `xine-extra >= 1.1.1-24.43` `xine-lib >= 1.1.1-24.43` `xine-lib-32bit >= 1.1.1-24.43` `xine-ui >= 0.99.4-32.39`	sles10-sp2-sdk. s390x sles10-sp2-sdk. x86 sled10-sp2. x86-64 sles10-sp2-sdk. ppc sles10-sp2-sdk. x86-64 sled10-sp2. x86 sles10-sp2-sdk. ia64 ZYPP Patch Nr: 5965
openSUSE 10.3	`xine-devel >= 1.1.8-14.11` `xine-extra >= 1.1.8-14.11` `xine-lib >= 1.1.8-14.11` `xine-lib-32bit >= 1.1.8-14.11` `xine-lib-64bit >= 1.1.8-14.11`	ZYPP Patch Nr: 5966 SAT Patch Nr: 483
openSUSE 11.0	`xine-lib-debuginfo >= 1.1.12-8.2` `xine-lib-debugsource >= 1.1.12-8.2`	ZYPP Patch Nr: 5966 SAT Patch Nr: 483
openSUSE 11.0	`xine-devel >= 1.1.12-8.2` `xine-extra >= 1.1.12-8.2` `xine-lib >= 1.1.12-8.2` `xine-lib-32bit >= 1.1.12-8.2` `xine-lib-64bit >= 1.1.12-8.2`	ZYPP Patch Nr: 5966 SAT Patch Nr: 483
Novell Linux Desktop 9 for x86	`xine-lib >= 0.99.rc3a-106.49`	sles9-nld. x86-64 core9. x86-64 core9. s390 sles9-nld. x86 core9. x86 sles9-nld. x86 sles9-nld. x86-64 core9. ppc core9. s390x core9. ia64 YOU Patch Nr: 12346
Novell Linux Desktop 9 for x86_64	`xine-lib >= 0.99.rc3a-106.49` `xine-lib-32bit >= 9-200901281640`	sles9-nld. x86-64 core9. x86-64 core9. s390 sles9-nld. x86 core9. x86 sles9-nld. x86 sles9-nld. x86-64 core9. ppc core9. s390x core9. ia64 YOU Patch Nr: 12346
SLES SDK 9 for IPF	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-lib-x86 >= 9-200901281640` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld. x86-64 core9. x86-64 core9. s390 sles9-nld. x86 core9. x86 sles9-nld. x86 sles9-nld. x86-64 core9. ppc core9. s390x core9. ia64 YOU Patch Nr: 12346
SLES SDK 9 for IBM iSeries and IBM pSeries	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-lib-64bit >= 9-200901281643` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld. x86-64 core9. x86-64 core9. s390 sles9-nld. x86 core9. x86 sles9-nld. x86 sles9-nld. x86-64 core9. ppc core9. s390x core9. ia64 YOU Patch Nr: 12346
Novell Linux Desktop 9 SDK for x86 SLES SDK 9 for IBM S/390 and IBM zSeries SLES SDK 9 for x86	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld. x86-64 core9. x86-64 core9. s390 sles9-nld. x86 core9. x86 sles9-nld. x86 sles9-nld. x86-64 core9. ppc core9. s390x core9. ia64 YOU Patch Nr: 12346
SLES SDK 9 for IBM zSeries	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-lib-32bit >= 9-200901281627` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld. x86-64 core9. x86-64 core9. s390 sles9-nld. x86 core9. x86 sles9-nld. x86 sles9-nld. x86-64 core9. ppc core9. s390x core9. ia64 YOU Patch Nr: 12346
Novell Linux Desktop 9 SDK for x86_64 SLES SDK 9 for X86-64	`xine-devel >= 0.99.rc3a-106.49` `xine-extra >= 0.99.rc3a-106.49` `xine-lib >= 0.99.rc3a-106.49` `xine-lib-32bit >= 9-200901281640` `xine-ui >= 0.99.rc3a-106.49`	sles9-nld. x86-64 core9. x86-64 core9. s390 sles9-nld. x86 core9. x86 sles9-nld. x86 sles9-nld. x86-64 core9. ppc core9. s390x core9. ia64 YOU Patch Nr: 12346