Date: Wed, 3 Dec 2008 19:28:18 +0100 From: Nico Golde <oss-security+ml@...lde.de> To: oss-security@...ts.openwall.com Cc: redpig@...rt.org, coley@...re.org Subject: Re: xine-lib and ocert-2008-008 Hi, * Steven M. Christey <coley@...us.mitre.org> [2008-11-26 09:27]: > ====================================================== > Name: CVE-2008-5235 > Status: Candidate > URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5235 > Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?release_id=619869 > Reference: FRSIRT:ADV-2008-2382 > Reference: URL:http://www.frsirt.com/english/advisories/2008/2382 > Reference: SECTRACK:1020703 > Reference: URL:http://securitytracker.com/id?1020703 > Reference: SECUNIA:31502 > Reference: URL:http://secunia.com/advisories/31502 > > Heap-based buffer overflow in the demux_real_send_chunk function in > src/demuxers/demux_real.c in xine-lib before 1.1.15 allows remote > attackers to execute arbitrary code via a crafted Real Media file. > NOTE: some of these details are obtained from third party information. > > > ====================================================== > Name: CVE-2008-5236 > Status: Candidate > URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5236 > Reference: BUGTRAQ:20080822 [oCERT-2008-008] multiple heap overflows in xine-lib > Reference: URL:http://www.securityfocus.com/archive/1/archive/1/495674/100/0/threaded > Reference: MISC:http://sourceforge.net/project/shownotes.php?release_id=619869 > Reference: MISC:http://www.ocert.org/analysis/2008-008/analysis.txt > Reference: BID:30797 > Reference: URL:http://www.securityfocus.com/bid/30797 > Reference: FRSIRT:ADV-2008-2382 > Reference: URL:http://www.frsirt.com/english/advisories/2008/2382 > Reference: FRSIRT:ADV-2008-2427 > Reference: URL:http://www.frsirt.com/english/advisories/2008/2427 > Reference: SECUNIA:31502 > Reference: URL:http://secunia.com/advisories/31502 > Reference: SECUNIA:31567 > Reference: URL:http://secunia.com/advisories/31567 > > Multiple heap-based buffer overflows in xine-lib 1.1.12, and other > 1.1.15 and earlier versions, allow remote attackers to execute > arbitrary code via vectors related to (1) a crafted EBML element > length processed by the parse_block_group function in > demux_matroska.c; (2) a certain combination of sps, w, and h values > processed by the real_parse_audio_specific_data and > demux_real_send_chunk functions in demux_real.c; and (3) an > unspecified combination of three values processed by the open_ra_file > function in demux_realaudio.c. NOTE: vector 2 reportedly exists > because of an incomplete fix in 1.1.15. Please reject either CVE-2008-5235 or remove the part about demux_real_send_chunk from CVE-2008-5236. I digged in the code for quite some time now and also talked to upstream now cause I couldn't see a difference. This is the same issue. Cheers Nico -- Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted. Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.