CVE-2009-0698 - Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attack

CVE-2009-0698

Summary

Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385.

References

Vulnerable Configurations

cpe:2.3:a:xine:xine-lib:1.1.16.1:*:*:*:*:*:*:*
cpe:2.3:a:xine:xine-lib:1.1.16.1:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 10-10-2018 - 19:30)
Impact:
Exploitability:

CWE

CWE-189

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bugtraq	20090128 [TKADV2009-004] FFmpeg Type Conversion Vulnerability
confirm	http://bugs.xine-project.org/show_bug.cgi?id=205 http://sourceforge.net/project/shownotes.php?release_id=660071
mandriva	MDVSA-2009:298 MDVSA-2009:299
misc	http://www.trapkit.de/advisories/TKADV2009-004.txt
suse	SUSE-SR:2009:009
ubuntu	USN-746-1
xf	xinelib-4xmdemuxer-code-execution(48954)

Last major update

10-10-2018 - 19:30

Published

23-02-2009 - 15:30

Last modified

10-10-2018 - 19:30