CVE-2009-1274

xine-lib - Remote Code Execution via Large STTS Atom Count in Quicktime Movie File

Title source: llm
STIX 2.1

Description

Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow.

References (17)

Core 17
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34593
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/502481/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021989
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/53288
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2009:299
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/49714
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34384
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35416
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2009:298
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34712
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0937

Scores

EPSS 0.0506
EPSS Percentile 91.3%

Details

CWE
CWE-119
Status published
Products (12)
xine/xine-lib 1.1.0
xine/xine-lib 1.1.1
xine/xine-lib 1.1.10
xine/xine-lib 1.1.10.1
xine/xine-lib 1.1.11
xine/xine-lib 1.1.11.1
xine/xine-lib 1.1.12
xine/xine-lib 1.1.13
xine/xine-lib 1.1.14
xine/xine-lib 1.1.15
... and 2 more
Published Apr 08, 2009
Tracked Since Feb 18, 2026