Detections
Analytics
Mandriva Linux Security Advisory : xine-lib (MDVSA-2009:020)
critical Nessus Plugin ID 36846
Synopsis
The remote Mandriva Linux host is missing one or more security updates.Description
Failure on Ogg files manipulation can lead remote attackers to cause a denial of service by using crafted files (CVE-2008-3231).Failure on manipulation of either MNG or Real or MOD files can lead remote attackers to cause a denial of service by using crafted files (CVE: CVE-2008-5233).
Heap-based overflow allows remote attackers to execute arbitrary code by using Quicktime media files holding crafted metadata (CVE-2008-5234).
Heap-based overflow allows remote attackers to execute arbitrary code by using either crafted Matroska or Real media files (CVE-2008-5236).
Failure on manipulation of either MNG or Quicktime files can lead remote attackers to cause a denial of service by using crafted files (CVE-2008-5237).
Multiple heap-based overflow on input plugins (http, net, smb, dvd, dvb, rtsp, rtp, pvr, pnm, file, gnome_vfs, mms) allow attackers to execute arbitrary code by handling that input channels. Further this problem can even lead attackers to cause denial of service (CVE-2008-5239).
Heap-based overflow allows attackers to execute arbitrary code by using crafted Matroska media files (MATROSKA_ID_TR_CODECPRIVATE track entry element). Further a failure on handling of Real media files (CONT_TAG header) can lead to a denial of service attack (CVE-2008-5240).
Integer underflow allows remote attackers to cause denial of service by using Quicktime media files (CVE-2008-5241).
Failure on manipulation of Real media files can lead remote attackers to cause a denial of service by indexing an allocated buffer with a certain input value in a crafted file (CVE-2008-5243).
Vulnerabilities of unknown impact - possibly buffer overflow - caused by a condition of video frame preallocation before ascertaining the required length in V4L video input plugin (CVE-2008-5245).
Heap-based overflow allows remote attackers to execute arbitrary code by using crafted media files. This vulnerability is in the manipulation of ID3 audio file data tagging mainly used in MP3 file formats (CVE-2008-5246).
This update provides the fix for all these security issues found in xine-lib 1.1.11 of Mandriva 2008.1. The vulnerabilities:
CVE-2008-5234, CVE-2008-5236, CVE-2008-5237, CVE-2008-5239, CVE-2008-5240, CVE-2008-5243 are found in xine-lib 1.1.15 of Mandriva 2009.0 and are also fixed by this update.
Solution
Update the affected packages.Plugin Details
Severity: Critical
ID: 36846
File Name: mandriva_MDVSA-2009-020.nasl
Version: 1.17
Type: local
Family: Mandriva Local Security Checks
Published: 4/23/2009
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:mandriva:linux:lib64xine-devel, p-cpe:/a:mandriva:linux:lib64xine1, p-cpe:/a:mandriva:linux:libxine-devel, p-cpe:/a:mandriva:linux:libxine1, p-cpe:/a:mandriva:linux:xine-aa, p-cpe:/a:mandriva:linux:xine-caca, p-cpe:/a:mandriva:linux:xine-dxr3, p-cpe:/a:mandriva:linux:xine-esd, p-cpe:/a:mandriva:linux:xine-flac, p-cpe:/a:mandriva:linux:xine-gnomevfs, p-cpe:/a:mandriva:linux:xine-image, p-cpe:/a:mandriva:linux:xine-jack, p-cpe:/a:mandriva:linux:xine-plugins, p-cpe:/a:mandriva:linux:xine-pulse, p-cpe:/a:mandriva:linux:xine-sdl, p-cpe:/a:mandriva:linux:xine-smb, p-cpe:/a:mandriva:linux:xine-wavpack, cpe:/o:mandriva:linux:2008.1, cpe:/o:mandriva:linux:2009.0
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 1/21/2009
Reference Information
CVE: CVE-2008-3231, CVE-2008-5233, CVE-2008-5234, CVE-2008-5236, CVE-2008-5237, CVE-2008-5239, CVE-2008-5240, CVE-2008-5241, CVE-2008-5243, CVE-2008-5245, CVE-2008-5246