CVSS: 6.8EPSS: 7%CPEs: 1EXPL: 4CVE-2008-1482 – Xine-Lib 1.1.11 - Multiple Heap Remote Buffer Overflow Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-1482
Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via (1) a crafted .FLV file, which triggers an overflow in demuxers/demux_flv.c; (2) a crafted .MOV file, which triggers an overflow in demuxers/demux_qt.c; (3) a crafted .RM file, which triggers an overflow in demuxers/demux_real.c; (4) a crafted .MVE file, which triggers an overflow in demuxers/demux_wc3movie.c; (5) a crafted .MKV file, which triggers an overflow in demuxers/ebml.c; or (6) a crafted .CAK file, which triggers an overflow in demuxers/demux_film.c. Múltiples desbordamientos de entero en xine-lib 1.1.11 y anteriores permiten a atacantes remotos disparar desbordamientos de búfer basados en montículo y posiblemente ejecutar código de su elección a través de (1) un archivo .FLV manipulado, que dispara un desbordamiento en demuxers/demux_flv.c; (2) un archivo .MOV manipulado, que dispara un desbordamiento en demuxers/demux_qt.c; (3) un archivo .RM manipulado, que dispara un desbordamiento en demuxers/demux_real.c; (4) un archivo .MVE manipulado, que dispara un desbordamiento en demuxers/demux_wvc3movie.c; (5) un archivo .MKV manipulado, que dispara un desbordamiento en demuxers/ebml.c; o (6) un archivo .CAK manipulado, que dispara un desbordamiento en demuxers/demux_film.c. • https://www.exploit-db.com/exploits/31462 http://aluigi.altervista.org/adv/xinehof-adv.txt http://aluigi.org/poc/xinehof.zip http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html http://secunia.com/advisories/29484 http://secunia.com/advisories/29600 http://secunia.com/advisories/29622 http://secunia.com/advisories/29740 http://secunia.com/advisories/29756 http://secunia.com/advisories/30337 http://secunia.com/advisories/31372 http://secunia.com/advis • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 33%CPEs: 31EXPL: 2CVE-2006-1905 – Xine 0.9/1.0 - Playlist Handling Remote Format String
https://notcve.org/view.php?id=CVE-2006-1905
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file. • https://www.exploit-db.com/exploits/27670 http://open-security.org/advisories/16 http://secunia.com/advisories/19671 http://secunia.com/advisories/19854 http://secunia.com/advisories/20066 http://securitytracker.com/id?1015959 http://sourceforge.net/mailarchive/message.php?msg_id=15429845 http://www.gentoo.org/security/en/glsa/glsa-200604-15.xml http://www.mandriva.com/security/advisories?name=MDKSA-2006:085 http://www.novell.com/linux/security/advisories/2006_05_05.html http& •
CVSS: 5.0EPSS: 0%CPEs: 27EXPL: 2CVE-2004-1951 – Xine 0.9.x and Xine-Lib 1 - Multiple Remote File Overwrite Vulnerabilities
https://notcve.org/view.php?id=CVE-2004-1951
xine 1.x alpha, 1.x beta, and 1.0rc through 1.0rc3a, and xine-ui 0.9.21 to 0.9.23 allows remote attackers to overwrite arbitrary files via the (1) audio.sun_audio_device or (2) dxr3.devicename options in an MRL link. • https://www.exploit-db.com/exploits/24038 http://secunia.com/advisories/11433 http://security.gentoo.org/glsa/glsa-200404-20.xml http://www.osvdb.org/5594 http://www.osvdb.org/5739 http://www.securityfocus.com/bid/10193 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.372791 http://www.xinehq.de/index.php/security/XSA-2004-1 http://www.xinehq.de/index.php/security/XSA-2004-2 https://exchange.xforce.ibmcloud.com/vulnerabi •
CVSS: 5.1EPSS: 0%CPEs: 10EXPL: 1CVE-2004-1475 – xine 0.99.2 - Remote Stack Overflow
https://notcve.org/view.php?id=CVE-2004-1475
Multiple stack-based buffer overflows in xine-lib 1-rc2 through 1-rc5 allow attackers to execute arbitrary code via (1) long VideoCD vcd:// MRLs or (2) long subtitle lines. • https://www.exploit-db.com/exploits/386 http://security.gentoo.org/glsa/glsa-200408-18.xml http://www.gentoo.org/security/en/glsa/glsa-200409-30.xml http://www.securityfocus.com/archive/1/375485/2004-09-02/2004-09-08/0 http://www.securityfocus.com/bid/11206 http://xinehq.de/index.php/security/XSA-2004-4 https://exchange.xforce.ibmcloud.com/vulnerabilities/17430 https://exchange.xforce.ibmcloud.com/vulnerabilities/17432 •
CVSS: 5.1EPSS: 0%CPEs: 17EXPL: 0CVE-2004-1476
https://notcve.org/view.php?id=CVE-2004-1476
Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label. • http://www.gentoo.org/security/en/glsa/glsa-200409-30.xml http://www.securityfocus.com/archive/1/375485/2004-09-02/2004-09-08/0 http://www.securityfocus.com/bid/11206 http://xinehq.de/index.php/security/XSA-2004-4 https://exchange.xforce.ibmcloud.com/vulnerabilities/17431 •