First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 205197
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Lars Hartmann <lars@chaotika.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 205197 depends on: Show dependency tree
Show dependency graph
Bug 205197 blocks:

Additional Comments: (this is where you put emerge --info)







View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2008-01-10 13:05 0000 
The vulnerabilities are caused due to boundary errors within the
"rmff_dump_cont()" function in input/libreal/rmff.c when processing the SDP
"Title", "Author", Copyright", and "Abstract" attributes. These can be
exploited to cause a heap-based buffer overflow by tricking the user into
connecting to a malicious RTSP server.

Successful exploitation may allow execution of arbitrary code.

The vulnerabilities are confirmed in version 1.1.9. Other versions may also be
affected.

Solution: no upstream fix avaible, so "Do not connect to untrusted streaming
servers."...

------- Comment #1 From Robert Buchholz 2008-01-10 13:55:32 0000 ------- 
Media-video, please advise.

------- Comment #2 From Alexis Ballier 2008-01-11 18:02:42 0000 ------- 
xine-lib 1.1.9.1 is in the tree and candidate for stable, see changelog why
there is a -r1 too...

------- Comment #3 From Sune Kloppenborg Jeppesen 2008-01-13 14:15:24 0000 ------- 
Arches please test and mark stable. Target keywords are:

xine-lib-1.1.9.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
~x86-fbsd"

------- Comment #4 From Brent Baude 2008-01-13 19:07:23 0000 ------- 
ppc64 done

------- Comment #5 From Tobias Scherbaum 2008-01-13 19:52:00 0000 ------- 
(In reply to comment #3)
> Arches please test and mark stable. Target keywords are:
> 
> xine-lib-1.1.9.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
> ~x86-fbsd"
> 

which should be 1.1.9.1 according to the changelog, re-adding ppc64

xine-lib-1.1.9.1.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
~x86-fbsd"

------- Comment #6 From Brent Baude 2008-01-13 20:02:12 0000 ------- 
1.1.9.1 done now too. ppc64 stable

------- Comment #7 From Tobias Scherbaum 2008-01-13 20:08:14 0000 ------- 
ppc stable

------- Comment #8 From Markus Meier 2008-01-13 21:04:52 0000 ------- 
x86 stable

------- Comment #9 From Jeroen Roovers 2008-01-15 06:18:32 0000 ------- 
Stable for HPPA.

------- Comment #10 From Raúl Porcel 2008-01-16 12:18:30 0000 ------- 
alpha/ia64/sparc stable

------- Comment #11 From Peter Weller 2008-01-16 15:51:41 0000 ------- 
amd64 done.

------- Comment #12 From Sune Kloppenborg Jeppesen 2008-01-16 19:08:43 0000 ------- 
GLSA request filed.

------- Comment #13 From Robert Buchholz 2008-01-27 16:36:29 0000 ------- 
GLSA 200801-12, thanks.
First Last Prev Next    No search results available      Search page      Enter new bug