Candidate: CVE-2008-5234
PublicDate: 2008-11-26 01:30:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5234
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498243
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508313
 https://ubuntu.com/security/notices/USN-710-1
Description:
 Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions
 before 1.1.15, allow remote attackers to execute arbitrary code via vectors
 related to (1) a crafted metadata atom size processed by the
 parse_moov_atom function in demux_qt.c and (2) frame reading in the
 id3v23_interp_frame function in id3.c.  NOTE: as of 20081122, it is
 possible that vector 1 has not been fixed in 1.1.15.
Ubuntu-Description:
Notes:
 mdeslaur> Patch below fixes the (1) part. The (2) part appears to be
 mdeslaur> the same as CVE-2008-5246
 mdeslaur>
 mdeslaur> This is 1A ((2) is 1E)
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS: 

Patches_xine-lib:
 upstream: http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=6e81eec36701;style=gitweb
upstream_xine-lib: needs-triage
dapper_xine-lib: released (1.1.1+ubuntu2-7.10)
gutsy_xine-lib: released (1.1.7-1ubuntu1.4)
hardy_xine-lib: released (1.1.11.1-1ubuntu3.2)
intrepid_xine-lib: released (1.1.15-0ubuntu3.1)
devel_xine-lib: released (1.1.16.1-2ubuntu1)