CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2006-4799
https://notcve.org/view.php?id=CVE-2006-4799
Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file and "bad indexes", a different vulnerability than CVE-2005-4048 and CVE-2006-2802. Desbordamiento de búfer en ffmpeg para xine-lib anterior a 1.1.2 podría permitir a atacantes (locales o remotos dependiendo del contexto) ejecutar código de su elección mediante "índices erróneos" en un archivo AVI especialmente construido. Es una vulnerabilidad diferente a CVE-2005-4048 y CVE-2006-2802. • http://secunia.com/advisories/22230 http://secunia.com/advisories/23010 http://secunia.com/advisories/23213 http://www.gentoo.org/security/en/glsa/glsa-200609-09.xml http://www.novell.com/linux/security/advisories/2006_73_mono.html http://www.ubuntu.com/usn/usn-358-1 http://www.us.debian.org/security/2006/dsa-1215 http://xinehq.de/index.php/news •
CVSS: 5.1EPSS: 4%CPEs: 2EXPL: 0CVE-2006-2200
https://notcve.org/view.php?id=CVE-2006-2200
Stack-based buffer overflow in libmms, as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions. Desbordamiento de búfer basado en pila en libmms, utilizado por (a) MiMMs v0.0.9 y (b) xine-lib v1.1.0 y versiones anteriores, permite a atacantes remotos causar una denegación de servicio (cuelgue de aplicación) y posiblemente ejecutar código arbitrario a través de (1) send_command, (2) string_utf16, (3) get_data, y (4) funciones get_media_packet ,y posiblemente otras funciones. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577 http://secunia.com/advisories/20749 http://secunia.com/advisories/20948 http://secunia.com/advisories/20964 http://secunia.com/advisories/21023 http://secunia.com/advisories/21036 http://secunia.com/advisories/21139 http://secunia.com/advisories/23218 http://secunia.com/advisories/23512 http://security.gentoo.org/glsa/glsa-200607-07.xml http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-secu • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 20%CPEs: 5EXPL: 3CVE-2006-2802 – gxine 0.5.6 - HTTP Plugin Remote Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2006-2802
Buffer overflow in the HTTP Plugin (xineplug_inp_http.so) for xine-lib 1.1.1 allows remote attackers to cause a denial of service (application crash) via a long reply from an HTTP server, as demonstrated using gxine 0.5.6. Desbordamiento de búfer en el HTTP Plugin (xineplug_inp_http.so) para xine-lib 1.1.1 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través de una respuesta larga de un servidor HTTP, según lo demostrado usando gxine 0.5.6. • https://www.exploit-db.com/exploits/1852 http://lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html http://secunia.com/advisories/20369 http://secunia.com/advisories/20549 http://secunia.com/advisories/20766 http://secunia.com/advisories/20828 http://secunia.com/advisories/20942 http://secunia.com/advisories/21919 http://security.gentoo.org/glsa/glsa-200609-08.xml http://www.debian.org/security/2006/dsa-1105 http://www.mandriva.com/security/advisories?name= •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2006-2230 – Xine 0.99.x - Filename Handling Remote Format String
https://notcve.org/view.php?id=CVE-2006-2230
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition, if the only attack vectors involve a user-assisted, local command line argument of a non-setuid program, this issue might not be a vulnerability. • https://www.exploit-db.com/exploits/27791 http://www.debian.org/security/2006/dsa-1093 http://www.securityfocus.com/archive/1/432598/100/0/threaded http://www.securityfocus.com/bid/17769 https://exchange.xforce.ibmcloud.com/vulnerabilities/26216 •
CVSS: 7.5EPSS: 33%CPEs: 31EXPL: 2CVE-2006-1905 – Xine 0.9/1.0 - Playlist Handling Remote Format String
https://notcve.org/view.php?id=CVE-2006-1905
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file. • https://www.exploit-db.com/exploits/27670 http://open-security.org/advisories/16 http://secunia.com/advisories/19671 http://secunia.com/advisories/19854 http://secunia.com/advisories/20066 http://securitytracker.com/id?1015959 http://sourceforge.net/mailarchive/message.php?msg_id=15429845 http://www.gentoo.org/security/en/glsa/glsa-200604-15.xml http://www.mandriva.com/security/advisories?name=MDKSA-2006:085 http://www.novell.com/linux/security/advisories/2006_05_05.html http& •