CVSS: 7.5EPSS: 1%CPEs: 49EXPL: 0CVE-2008-5243
https://notcve.org/view.php?id=CVE-2008-5243
26 Nov 2008 — The real_parse_headers function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input length value to "reindex into an allocated buffer," which allows remote attackers to cause a denial of service (crash) via a crafted value, probably an array index error. La función real_parse_headers en demux_real.c en xine-lib 1.1.12, y otras v1.1.15 y versiones anteriores, confía en un valor de longitud de entrada no confiable a "reindexar en un búfer asignado", lo que p... • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 49EXPL: 0CVE-2008-5244
https://notcve.org/view.php?id=CVE-2008-5244
26 Nov 2008 — Unspecified vulnerability in xine-lib before 1.1.15 has unknown impact and attack vectors related to libfaad. NOTE: due to the lack of details, it is not clear whether this is an issue in xine-lib or in libfaad. Vulnerabilidad no especificada en xine-lib anterior a v1.1.15, tiene un impacto desconocido y vectores de ataque relacionados con libfaad. NOTA: Debido a la falta de detalles, no está claro si es una vulnerabilidad que afecta a xine-lib o a libfaad. • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html •
CVSS: 9.8EPSS: 1%CPEs: 48EXPL: 0CVE-2008-5245
https://notcve.org/view.php?id=CVE-2008-5245
26 Nov 2008 — xine-lib before 1.1.15 performs V4L video frame preallocation before ascertaining the required length, which has unknown impact and attack vectors, possibly related to a buffer overflow in the open_video_capture_device function in src/input/input_v4l.c. xine-lib anterior a 1.1.15 realiza marcos de video V4L preasignados antes del establecimiento de la longitud requerida, la cuál tiene un impacto y vectores de ataque desconocidos, posiblemente relacionado con un desbordamiento de búfer en la función open_vid... • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 4%CPEs: 48EXPL: 0CVE-2008-5246
https://notcve.org/view.php?id=CVE-2008-5246
26 Nov 2008 — Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22_interp_frame and (2) id3v24_interp_frame functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Múltiples desbordamientos de búfer basados en montículo en xine-lib anterior a 1.1.15; permiten a atacantes remotos ejecutar código de su elección a a través de v... • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 49EXPL: 0CVE-2008-5247
https://notcve.org/view.php?id=CVE-2008-5247
26 Nov 2008 — The real_parse_audio_specific_data function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, uses an untrusted height (aka codec_data_length) value as a divisor, which allow remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero value. La función real_parse_audio_specific_data en demux_real.c en xine-lib v1.1.12, y otros 1.1.15 y versiones anteriores, utiliza un valor de altura no confiable (también conocido como codec_data_length) como divisor, l... • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 0%CPEs: 49EXPL: 0CVE-2008-5248
https://notcve.org/view.php?id=CVE-2008-5248
26 Nov 2008 — xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via "MP3 files with metadata consisting only of separators." xine-lib anterior a 1.1.15 permite a atacantes remotos causar una denegación de servicio(caída)a través de "archivos MP3 con metadatos que consisten únicamente de separadores." • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 8%CPEs: 31EXPL: 2CVE-2006-1905 – Xine 0.9/1.0 - Playlist Handling Remote Format String
https://notcve.org/view.php?id=CVE-2006-1905
20 Apr 2006 — Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file. • https://www.exploit-db.com/exploits/27670 •
CVSS: 9.8EPSS: 5%CPEs: 10EXPL: 1CVE-2004-1475 – xine 0.99.2 - Remote Stack Overflow
https://notcve.org/view.php?id=CVE-2004-1475
31 Dec 2004 — Multiple stack-based buffer overflows in xine-lib 1-rc2 through 1-rc5 allow attackers to execute arbitrary code via (1) long VideoCD vcd:// MRLs or (2) long subtitle lines. • https://www.exploit-db.com/exploits/386 •
CVSS: 9.8EPSS: 2%CPEs: 17EXPL: 0CVE-2004-1476
https://notcve.org/view.php?id=CVE-2004-1476
31 Dec 2004 — Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label. • http://www.gentoo.org/security/en/glsa/glsa-200409-30.xml •
CVSS: 7.5EPSS: 2%CPEs: 27EXPL: 2CVE-2004-1951 – Xine 0.9.x and Xine-Lib 1 - Multiple Remote File Overwrite Vulnerabilities
https://notcve.org/view.php?id=CVE-2004-1951
31 Dec 2004 — xine 1.x alpha, 1.x beta, and 1.0rc through 1.0rc3a, and xine-ui 0.9.21 to 0.9.23 allows remote attackers to overwrite arbitrary files via the (1) audio.sun_audio_device or (2) dxr3.devicename options in an MRL link. • https://www.exploit-db.com/exploits/24038 •