CVE

Id
35351  
CVE No.
CVE-2008-5234  
Status
Candidate  
Description
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c. NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15.  
Phase
Assigned (20081125)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
387405 35351 CVE-2008-5234 BUGTRAQ:20080822 [oCERT-2008-008] multiple heap overflows in xine-lib  View
387406 35351 CVE-2008-5234 URL:http://www.securityfocus.com/archive/1/archive/1/495674/100/0/threaded  View
387407 35351 CVE-2008-5234 MISC:http://www.ocert.org/analysis/2008-008/analysis.txt  View
387408 35351 CVE-2008-5234 CONFIRM:http://sourceforge.net/project/shownotes.php?release_id=619869  View
387409 35351 CVE-2008-5234 FEDORA:FEDORA-2009-0542  View
387410 35351 CVE-2008-5234 URL:https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00555.html  View
387411 35351 CVE-2008-5234 FEDORA:FEDORA-2008-7512  View
387412 35351 CVE-2008-5234 URL:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00385.html  View
387413 35351 CVE-2008-5234 FEDORA:FEDORA-2008-7572  View
387414 35351 CVE-2008-5234 URL:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00174.html  View
387415 35351 CVE-2008-5234 MANDRIVA:MDVSA-2009:020  View
387416 35351 CVE-2008-5234 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2009:020  View
387417 35351 CVE-2008-5234 SUSE:SUSE-SR:2009:004  View
387418 35351 CVE-2008-5234 URL:http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html  View
387419 35351 CVE-2008-5234 BID:30797  View
387420 35351 CVE-2008-5234 URL:http://www.securityfocus.com/bid/30797  View
387421 35351 CVE-2008-5234 SECUNIA:31827  View
387422 35351 CVE-2008-5234 URL:http://secunia.com/advisories/31827  View
387423 35351 CVE-2008-5234 VUPEN:ADV-2008-2382  View
387424 35351 CVE-2008-5234 URL:http://www.vupen.com/english/advisories/2008/2382  View
387425 35351 CVE-2008-5234 SECTRACK:1020703  View
387426 35351 CVE-2008-5234 URL:http://securitytracker.com/id?1020703  View
387427 35351 CVE-2008-5234 SECUNIA:31502  View
387428 35351 CVE-2008-5234 URL:http://secunia.com/advisories/31502  View
387429 35351 CVE-2008-5234 SECUNIA:33544  View
387430 35351 CVE-2008-5234 URL:http://secunia.com/advisories/33544  View
387431 35351 CVE-2008-5234 SREASON:4648  View
387432 35351 CVE-2008-5234 URL:http://securityreason.com/securityalert/4648  View
387433 35351 CVE-2008-5234 XF:xinelib-id3v23interpframe-bo(44647)  View
387434 35351 CVE-2008-5234 URL:http://xforce.iss.net/xforce/xfdb/44647  View
387435 35351 CVE-2008-5234 XF:xinelib-parsemoovatom-bo(44633)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
51174 JVNDB-2008-006484 xine-lib の demux_real.c の real_parse_mdpr 関数における整数オーバーフローの脆弱性 xine-lib の demux_real.c の real_parse_mdpr 関数には、整数オーバーフローの脆弱性が存在します。 CVE-2008-5238 35351 7.1 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-006484.html  View