CVE-2008-5242

Published: 25 November 2008

demux_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not validate the count field before calling calloc for STSD_ATOM atom allocation, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.

Notes

Author	Note
mdeslaur	combined with fix for CVE-2008-5234

Priority

Status

Package	Release	Status
xine-lib Launchpad, Ubuntu, Debian	dapper	Released (1.1.1+ubuntu2-7.10)
	gutsy	Released (1.1.7-1ubuntu1.4)
	hardy	Released (1.1.11.1-1ubuntu3.2)
	intrepid	Released (1.1.15-0ubuntu3.1)
	upstream	Needs triage

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498243
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507165
https://ubuntu.com/security/notices/USN-710-1
https://www.cve.org/CVERecord?id=CVE-2008-5242
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›