xine-lib: Format string vulnerability
漏洞ID | 1053310 | 漏洞类型 | |
发布时间 | 2005-10-09 | 更新时间 | 2005-10-09 |
CVE编号 | N/A | CNNVD-ID | N/A |
漏洞平台 | N/A | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200510-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: xine-lib: Format string vulnerability
Date: October 08, 2005
Bugs: #107854
ID: 200510-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
xine-lib contains a format string error in CDDB response handling that
may be exploited to execute arbitrary code.
Background
==========
xine-lib is a multimedia library which can be utilized to create
multimedia frontends. It includes functions to retrieve information
about audio CD contents from public CDDB servers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-libs/xine-lib < 1.1.0-r5 >= 1.1.0-r5
*>= 1.0.1-r4
*>= 1_rc8-r2
Description
===========
Ulf Harnhammar discovered a format string bug in the routines handling
CDDB server response contents.
Impact
======
An attacker could submit malicious information about an audio CD to a
public CDDB server (or impersonate a public CDDB server). When the
victim plays this CD on a multimedia frontend relying on xine-lib, it
could end up executing arbitrary code.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All xine-lib users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose media-libs/xine-lib
References
==========
[ 1 ] CAN-2005-2967
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2967
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200510-08.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security (at) gentoo (dot) org [email concealed] or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
相关推荐: D-Link DI-704P Syslog.HTM Denial Of Service Vulnerability
D-Link DI-704P Syslog.HTM Denial Of Service Vulnerability 漏洞ID 1100165 漏洞类型 Input Validation Error 发布时间 2003-05-26 更新时间 2003-05-26…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666