National Cyber Awareness System

Vulnerability Summary for CVE-2008-0225

Overview

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmff_dump_header function and related to disregarding the max field. NOTE: some of these details are obtained from third party information.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2008-0718

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00592.html

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=428620

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=428620

External Source: VUPEN

Name: ADV-2008-0163

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2008/0163

External Source: UBUNTU

Name: USN-635-1

Hyperlink:http://www.ubuntu.com/usn/usn-635-1

External Source: BID

Name: 27198

Hyperlink:http://www.securityfocus.com/bid/27198

External Source: SUSE

Name: SUSE-SR:2008:002

Hyperlink:http://www.novell.com/linux/security/advisories/suse_security_summary_report.html

External Source: MANDRIVA

Name: MDVSA-2008:045

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:045

External Source: MANDRIVA

Name: MDVSA-2008:020

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:020

External Source: DEBIAN

Name: DSA-1472

Hyperlink:http://www.debian.org/security/2008/dsa-1472

External Source: CONFIRM

Name: http://sourceforge.net/project/shownotes.php?release_id=567872

Hyperlink:http://sourceforge.net/project/shownotes.php?release_id=567872

External Source: GENTOO

Name: GLSA-200801-12

Hyperlink:http://security.gentoo.org/glsa/glsa-200801-12.xml

External Source: SECUNIA

Name: 31393

Type: Advisory

Hyperlink:http://secunia.com/advisories/31393

External Source: SECUNIA

Name: 28955

Type: Advisory

Hyperlink:http://secunia.com/advisories/28955

External Source: SECUNIA

Name: 28674

Type: Advisory

Hyperlink:http://secunia.com/advisories/28674

External Source: SECUNIA

Name: 28636

Type: Advisory

Hyperlink:http://secunia.com/advisories/28636

External Source: SECUNIA

Name: 28507

Type: Advisory

Hyperlink:http://secunia.com/advisories/28507

External Source: SECUNIA

Name: 28489

Type: Advisory

Hyperlink:http://secunia.com/advisories/28489

External Source: SECUNIA

Name: 28384

Type: Advisory

Hyperlink:http://secunia.com/advisories/28384

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=205197

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=205197

External Source: MISC

Name: http://aluigi.altervista.org/adv/xinermffhof-adv.txt

Hyperlink:http://aluigi.altervista.org/adv/xinermffhof-adv.txt