[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0904081359540.29367@faron.mitre.org>
Date: Wed, 8 Apr 2009 13:59:58 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security <oss-security@...ts.openwall.com>
cc: coley@...re.org
Subject: Re: CVE Request (xine-lib)
======================================================
Name: CVE-2009-1274
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1274
Reference: BUGTRAQ:20090404 [TKADV2009-005] xine-lib Quicktime STTS Atom Integer Overflow
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/502481/100/0/threaded
Reference: MISC:http://www.trapkit.de/advisories/TKADV2009-005.txt
Reference: CONFIRM:http://bugs.xine-project.org/show_bug.cgi?id=224
Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=673233
Reference: OSVDB:53288
Reference: URL:http://osvdb.org/53288
Reference: SECTRACK:1021989
Reference: URL:http://www.securitytracker.com/id?1021989
Reference: SECUNIA:34593
Reference: URL:http://secunia.com/advisories/34593
Reference: VUPEN:ADV-2009-0937
Reference: URL:http://www.vupen.com/english/advisories/2009/0937
Reference: XF:xinelib-demuxqt-bo(49714)
Reference: URL:http://xforce.iss.net/xforce/xfdb/49714
Integer overflow in the qt_error parse_trak_atom function in
demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote
attackers to execute arbitrary code via a Quicktime movie file with a
large count value in an STTS atom, which triggers a heap-based buffer
overflow.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
