Home / mailings Gentoo-announce
Posted on 14 April 2007
Gentoo-announce--PmA2V3Z32TCmWXqIContent-Type: text/plain; charset=us-asciiContent-Disposition: inline- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory GLSA 200704-09- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: xine-lib: Heap-based buffer overflow Date: April 14, 2007 Bugs: #170208 ID: 200704-09- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis========xine-lib is vulnerable to a heap-based buffer overflow.Background==========xine-lib is the core library package for the xine media player.Affected packages================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-libs/xine-lib < 1.1.4-r2 >= 1.1.4-r2 ------------------------------------------------------------------- # Package 1 only applies to x86 users.Description===========xine-lib does not check boundaries on data being read into buffers fromDMO video files in code that is shared with MPlayer(DMO_VideoDecoder.c).Impact======An attacker could entice a user to play a specially crafted DMO videofile with a player using xine-lib, potentially resulting in theexecution of arbitrary code with the privileges of the user running theplayer.Workaround==========There is no known workaround at this time.Resolution==========All xine-lib users on the x86 platform should upgrade to the latestversion: # emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.4-r2"References========== [ 1 ] CVE-2007-1246 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1246Availability============This GLSA and any updates to it are available for viewing atthe Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200704-09.xmlConcerns?=========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users machines is of utmostimportance to us. Any security concerns should be addressed tosecurity@gentoo.org or alternatively, you may file a bug athttp://bugs.gentoo.org.License=======Copyright 2007 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.http://creativecommons.org/licenses/by-sa/2.5--PmA2V3Z32TCmWXqIContent-Type: application/pgp-signatureContent-Disposition: inline
