CVE-2008-0238

xine-lib < 1.1.9 - Remote Code Execution via SDP Attribute Buffer Overflow

Title source: llm
STIX 2.1

Description

Multiple heap-based buffer overflows in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 allow remote attackers to execute arbitrary code via the SDP (1) Title, (2) Author, or (3) Copyright attribute, related to the rmff_dump_header function, different vectors than CVE-2008-0225. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

References (9)

Core 9
Core References
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:045
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28955
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200801-12.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31393
Issue Tracking x_refsource_confirm
http://bugs.gentoo.org/show_bug.cgi?id=205197
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28384
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28674
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-635-1
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:020

Scores

EPSS 0.0421
EPSS Percentile 89.8%

Details

CWE
CWE-119
Status published
Products (1)
xine/xine-lib < 1.1.9
Published Jan 11, 2008
Tracked Since Feb 18, 2026