Bugzilla Bug 214270

Secunia:

Luigi Auriemma has reported some vulnerabilities in xine-lib, which
potentially can be exploited by malicious people to compromise a
user's system.

The vulnerabilities are caused due to integer overflow errors when
allocating memory in src/demuxers/demux_flv.c,
src/demuxers/demux_qt.c, src/demuxers/demux_real.c,
src/demuxers/demux_wc3movie.c, src/demuxers/ebml.c, and
src/demuxers/demux_film.c. These can be exploited to cause heap-based
buffer overflows via overly large fields included in e.g. FLV, MOV,
RM, MVE, MKV, and CAK files.

The vulnerabilities are reported in version 1.1.11. Other versions
may also be affected.

SOLUTION:
Do not open untrusted files using xine-lib.

PROVIDED AND/OR DISCOVERED BY:
Luigi Auriemma

ORIGINAL ADVISORY:
http://aluigi.altervista.org/adv/xinehof-adv.txt

flameeyes, are these fixed upstream?

These were not known to upstream until now, and it's now freakin' easter, don't
expect me to find a way to fix them before tuesday... incidentally I decided to
use easter as timeframe to clean up my office's cabling -_-;

FWIW, they should _all_ be fixed in 1.2 series, I suppose backporting the
relevant changes, if possible, would solve the issue. 1.2 makes good use of
calloc rather than using malloc directly.

Diego, is there any update here?

Upstream is handling it as bug 71:
http://bugs.xine-project.org/show_bug.cgi?id=71
There is a patch but I wasn't able to doublecheck its commit status yet, sorry
I'm behind with my own schedule.

Merged here:
http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=a3f2772fd14b;style=gitweb
http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=08bb2b5bfddd;style=gitweb

Although it seems this here is worth merging too:
http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=6f9e9feb84e5;style=gitweb

ping, flamy and others?

Ok, I should have checked before. Fixes released as 1.1.11.1 (omg!). Please
bump.

(In reply to comment #8)
> Ok, I should have checked before. Fixes released as 1.1.11.1 (omg!). Please
> bump.
> 

bumped; there was two (known to me) regressions in this release, they're
patched.

Arches, please test and mark stable:
=media-libs/xine-lib-1.1.11.1
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 release sparc x86"

Stable for HPPA.

ppc64 stable

Stable on alpha.

Tested =media-libs/xine-lib-1.1.11.1 USE="X a52 aac aalib alsa dts dvd flac
gnome gtk mad mng musepack nls opengl samba sdl speex theora truetype vcd vidix
vorbis xcb xinerama xv (-altivec) -arts -debug (-directfb) -dxr3 -esd -fbcon
-imagemagick -ipv6 -jack -libcaca -mmap (-modplug) -oss -pulseaudio (-real)
-v4l -wavpack (-win32codecs) (-xvmc)" on sparc.

- compiles fine
- no test failures
- no collisions
- works fine using dvds and vcds

# emerge --info
Portage 2.1.4.4 (default-linux/sparc/sparc64/2007.0, gcc-4.1.2, glibc-2.6.1-r0,
2.6.24-gentoo-r4 sparc64)
=================================================================
System uname: 2.6.24-gentoo-r4 sparc64 sun4u
Timestamp of tree: Tue, 08 Apr 2008 21:00:01 +0000
app-shells/bash:     3.2_p17-r1
dev-lang/python:     2.4.4-r9
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.23-r3
ACCEPT_KEYWORDS="sparc"
CBUILD="sparc-unknown-linux-gnu"
CFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe
-ggdb"
CHOST="sparc-unknown-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/fonts/fonts.conf /etc/gconf
/etc/revdep-rebuild /etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe
-ggdb"
DISTDIR="/tmp/distfiles"
FEATURES="collision-protect distlocks installsources metadata-transfer
parallel-fetch sandbox splitdebug strict test userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://distfiles.gentoo.org
http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LANG="de_DE.UTF-8"
LDFLAGS="-Wl,-O1"
LINGUAS="en de"
MAKEOPTS="-j10"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --stats --timeout=180 --exclude=/distfiles
--exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/sunrise
/usr/portage/local/layman/gnash-cvs /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="64bit 7zip X a52 aac aalib ace agg alsa artworkextra audacious
blender-game bluetooth bzip2 c++ caps clock-screen cups curl custom-cflags cvs
cxx dbus devhelp dga disk-partition divx doc dri dts dv dvd dvdread eds encode
evo exif fastcgi fat festival ffmpeg flac ftp fuse gd gif gimp gimpprint glade
gmedia gnome gnome-print gnomecanvas gpm grammar gtk hal hpn ieee1394 imap
ithreads javascript jpeg jpeg2k key-screen libsexy lyrics lzo mad mbrola
memcache midi mikmod mjpeg mng mouse mp2 mp3 mpeg mpeg2 mplayer musepack
musicbrainz nautilus ncurses network network-cron networking nls nptl nptlonly
nsplugin offensive ogg openal opengl openmp opera pam parallel pcre pdf png pnm
ppds qt3support quicktime raw realmedia regex ruby samba sasl sdl sdl-image
search-screen slang smartcard smp sms sound soundex source sourceview sparc
speex spell sqlite3 ssl subversion svg symlink taglib tagwriting theora threads
tiff timidity truetype tta unicode usb userlocales utils vcd vidix vim
vim-syntax vim-with-x vorbis wma wmf wmp wordexp x264 xanim xcb xfce xine
xinerama xorg xulrunner xv xvid zlib" ALSA_CARDS="CS4231"
ALSA_PCM_PLUGINS="adpcm alaw copy dshare dsnoop extplug file hooks ladspa
lfloat linear meter mulaw multi null rate route share shm" ELIBC="glibc"
INPUT_DEVICES="keyboard mouse" KERNEL="linux" LINGUAS="en de" USERLAND="GNU"
VIDEO_CARDS="mach64 fbdev mga"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL,
PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

ia64/sparc/x86 stable, thanks Friedrich

amd64 stable

ppc stable

Fixed in release snapshot.

GLSA 200808-01