Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.4
CVSSv2

CVE-2008-0225

Published: 10/01/2008 Updated: 17/10/2011
CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10
VMScore: 645
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Subscribe to Xine-lib

Vulnerability Summary

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and previous versions allows remote malicious users to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmff_dump_header function and related to disregarding the max field. NOTE: some of these details are obtained from third party information.

Vulnerable Product Search on Vulmon Subscribe to Product

xine xine-lib

Vendor Advisories

Ubuntu Security Notice: xine-lib vulnerabilities
Alin Rad Pop discovered an array index vulnerability in the SDP parser If a user or automated system were tricked into opening a malicious RTSP stream, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program (CVE-2008-0073) ...
Debian Security Advisories: DSA-1472-1 xine-lib -- buffer overflow
Luigi Auriemma discovered that the Xine media player library performed insufficient input sanitising during the handling of RTSP streams, which could lead to the execution of arbitrary code For the old stable distribution (sarge), this problem has been fixed in version 101-1sarge6 For the stable distribution (etch), this problem has been fixed ...

Exploits

Exploit DB: Xine-Lib 1.1.9 - 'rmff_dump_cont()' Remote Heap Buffer Overflow (PoC)
source: wwwsecurityfocuscom/bid/27198/info The xine-lib library is prone to a remote heap-based buffer-overflow vulnerability This issue occurs because the software fails to perform adequate boundary checks on user-supplied data An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the aff ...

References

CWE-119http://aluigi.altervista.org/adv/xinermffhof-adv.txthttp://secunia.com/advisories/28384https://bugzilla.redhat.com/show_bug.cgi?id=428620https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00592.htmlhttp://www.securityfocus.com/bid/27198http://secunia.com/advisories/28489http://sourceforge.net/project/shownotes.php?release_id=567872http://www.mandriva.com/security/advisories?name=MDVSA-2008:020http://www.novell.com/linux/security/advisories/suse_security_summary_report.htmlhttp://bugs.gentoo.org/show_bug.cgi?id=205197http://security.gentoo.org/glsa/glsa-200801-12.xmlhttp://secunia.com/advisories/28636http://secunia.com/advisories/28674http://www.debian.org/security/2008/dsa-1472http://secunia.com/advisories/28507http://www.mandriva.com/security/advisories?name=MDVSA-2008:045http://secunia.com/advisories/28955http://www.ubuntu.com/usn/usn-635-1http://secunia.com/advisories/31393http://www.vupen.com/english/advisories/2008/0163https://usn.ubuntu.com/635-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/31002/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322CVE-2006-4304wirelessCVE-2023-23022local file inclusionCVE-2024-27058CVE-2024-33820open redirectCVE-2024-27079
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook