NVD

Id
5018  
Name
CVE-2008-5234  
Description
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c. NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-11-25  
Modified Date
2011-03-07  
Seq
2008-5234  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
31364 5018 CVE-2008-5234 SUSE-SR:2009:004  View
31365 5018 CVE-2008-5234 4648  View
31366 5018 CVE-2008-5234 1020703  View
31367 5018 CVE-2008-5234 http://sourceforge.net/project/shownotes.php?release_id=619869  View
31368 5018 CVE-2008-5234 MDVSA-2009:020  View
31369 5018 CVE-2008-5234 http://www.ocert.org/analysis/2008-008/analysis.txt  View
31370 5018 CVE-2008-5234 20080822 [oCERT-2008-008] multiple heap overflows in xine-lib  View
31371 5018 CVE-2008-5234 30797  View
31372 5018 CVE-2008-5234 ADV-2008-2382  View
31373 5018 CVE-2008-5234 xinelib-parsemoovatom-bo(44633)  View
31374 5018 CVE-2008-5234 xinelib-id3v23interpframe-bo(44647)  View
31375 5018 CVE-2008-5234 FEDORA-2008-7572  View
31376 5018 CVE-2008-5234 FEDORA-2008-7512  View
31377 5018 CVE-2008-5234 FEDORA-2009-0542  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51170 JVNDB-2008-006480 xine-lib におけるヒープベースのバッファオーバーフローの脆弱性 xine-lib は、(1) demux_qt.c の parse_moov_atom 関数が実行する巧妙に細工されたメタデータの atom サイズ、および (2) id3.c の id3v23_interp_frame 関数のフレーム読み込みに関する処理に不備があるため、ヒープベースのバッファオーバーフローの脆弱性が存在します。 CVE-2008-5234 35347 CVE-2008-5234 5018 9.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-006480.html 2008-09-10 2012-12-20 View