Login
Newsletter
Werbung

Sicherheit: Zahlenüberläufe in xine-lib
Aktuelle Meldungen Distributionen
Name: Zahlenüberläufe in xine-lib
ID: MDVSA-2009:299
Distribution: Mandriva
Plattformen: Mandriva 2009.0
Datum: Sa, 14. November 2009, 01:33
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0698
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1274
Applikationen: Xine

Originalnachricht

This is a multi-part message in MIME format...

------------=_1258158809-24326-491


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2009:299
http://www.mandriva.com/security/
_______________________________________________________________________

Package : xine-lib
Date : November 13, 2009
Affected: 2009.0
_______________________________________________________________________

Problem Description:

Vulnerabilities have been discovered and corrected in xine-lib:

- Integer overflow in the qt_error parse_trak_atom function in
demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote
attackers to execute arbitrary code via a Quicktime movie file with a
large count value in an STTS atom, which triggers a heap-based buffer
overflow (CVE-2009-1274)

- Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c)
in xine-lib 1.1.16.1 allows remote attackers to cause a denial of
service (crash) and possibly execute arbitrary code via a 4X movie
file with a large current_track value, a similar issue to CVE-2009-0385
(CVE-2009-0698)

This update fixes these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1274
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0698
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2009.0:
fb9fd7c0dcd61f50d52b01cc676783e9
2009.0/i586/libxine1-1.1.15-2.2mdv2009.0.i586.rpm
4059f2e4da40e0bb24de331953f23d19
2009.0/i586/libxine-devel-1.1.15-2.2mdv2009.0.i586.rpm
ec26f58aba3362c639afe90421f849cb
2009.0/i586/xine-aa-1.1.15-2.2mdv2009.0.i586.rpm
469a024e880d16578f9b452cd36a7bb4
2009.0/i586/xine-caca-1.1.15-2.2mdv2009.0.i586.rpm
b4c70e62cb7a646642fe33358b862828
2009.0/i586/xine-dxr3-1.1.15-2.2mdv2009.0.i586.rpm
8ffd2011727d36096a3c9e213503149b
2009.0/i586/xine-esd-1.1.15-2.2mdv2009.0.i586.rpm
43e68a9e33467a12a33049f6d3a56e61
2009.0/i586/xine-flac-1.1.15-2.2mdv2009.0.i586.rpm
fd452dc5b071ac781dcf048965f031f9
2009.0/i586/xine-gnomevfs-1.1.15-2.2mdv2009.0.i586.rpm
3a2fc3ba57a619acc613881216400111
2009.0/i586/xine-image-1.1.15-2.2mdv2009.0.i586.rpm
d0a3556b014e33e901c0bf6912faede1
2009.0/i586/xine-jack-1.1.15-2.2mdv2009.0.i586.rpm
96752c5260e4087f47d26bbc07f3ff47
2009.0/i586/xine-plugins-1.1.15-2.2mdv2009.0.i586.rpm
fab007255d6495209751bdb0f6428d09
2009.0/i586/xine-pulse-1.1.15-2.2mdv2009.0.i586.rpm
634d4f89c46f8cc33807f181f0674336
2009.0/i586/xine-sdl-1.1.15-2.2mdv2009.0.i586.rpm
10615ae64934a4480a43a53a47f161fd
2009.0/i586/xine-smb-1.1.15-2.2mdv2009.0.i586.rpm
70b518ef60b1cecc0435f8aa121eb051
2009.0/i586/xine-wavpack-1.1.15-2.2mdv2009.0.i586.rpm
7811a2efeef30987718aad704f8ae446
2009.0/SRPMS/xine-lib-1.1.15-2.2mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
bfb6d51b14ec0b0abd123514c1970d31
2009.0/x86_64/lib64xine1-1.1.15-2.2mdv2009.0.x86_64.rpm
611c6a8f1bfb96e81b13f9e0b0635b06
2009.0/x86_64/lib64xine-devel-1.1.15-2.2mdv2009.0.x86_64.rpm
22dd167e57d178e2753fdd93d0ec2c63
2009.0/x86_64/xine-aa-1.1.15-2.2mdv2009.0.x86_64.rpm
2e114958881a763da576f0120d8d7e6f
2009.0/x86_64/xine-caca-1.1.15-2.2mdv2009.0.x86_64.rpm
1443f974b212c1f3b31dbe5169fd032c
2009.0/x86_64/xine-dxr3-1.1.15-2.2mdv2009.0.x86_64.rpm
97d1700ad74f3f97a62222dd642e5e6a
2009.0/x86_64/xine-esd-1.1.15-2.2mdv2009.0.x86_64.rpm
637683623d97760e72014a0c43f1d4d0
2009.0/x86_64/xine-flac-1.1.15-2.2mdv2009.0.x86_64.rpm
9ce1ab52e0b8d76f6f71a163eed5d35a
2009.0/x86_64/xine-gnomevfs-1.1.15-2.2mdv2009.0.x86_64.rpm
8fb3b5fbd4639ea76c791cdee36988b9
2009.0/x86_64/xine-image-1.1.15-2.2mdv2009.0.x86_64.rpm
cca7960d04ecde003c07e2066232e834
2009.0/x86_64/xine-jack-1.1.15-2.2mdv2009.0.x86_64.rpm
ebaa3c9218f962912f39806f58294bb8
2009.0/x86_64/xine-plugins-1.1.15-2.2mdv2009.0.x86_64.rpm
08beef3e962bdcb018497e8adfb8d1ab
2009.0/x86_64/xine-pulse-1.1.15-2.2mdv2009.0.x86_64.rpm
3362a3e7b3488f4dc2dbf2b93096b353
2009.0/x86_64/xine-sdl-1.1.15-2.2mdv2009.0.x86_64.rpm
7f936f14835edda80bf3498b8edbf733
2009.0/x86_64/xine-smb-1.1.15-2.2mdv2009.0.x86_64.rpm
d04f09f25d562ae483d00a175a6a0813
2009.0/x86_64/xine-wavpack-1.1.15-2.2mdv2009.0.x86_64.rpm
7811a2efeef30987718aad704f8ae446
2009.0/SRPMS/xine-lib-1.1.15-2.2mdv2009.0.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFK/c37mqjQ0CJFipgRAr/NAJ44AMyru1HhXlsvNV8C7iutUnFdtgCgiK18
tUG2bnKiZ6Vons5YNyYvPcA=
=g7fA
-----END PGP SIGNATURE-----


------------=_1258158809-24326-491
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1258158809-24326-491--
Pro-Linux
Unterstützer werden
Neue Nachrichten
Werbung