Bug 265250 – <media-libs/xine-lib-1.1.16.3: Integer overflow (CVE-2009-1274)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Alex Legler (RETIRED) 2009-04-07 06:33:59 UTC]

Quoting the advisory:

Xine-lib contains an integer overflow vulnerability while parsing malformed
STTS atoms of Quicktime movie files. The vulnerability may be exploited by 
a (remote) attacker to execute arbitrary code in the context of an 
application using the xine library.

Solution: Upgrade to xine-lib >= 1.1.16.3.

[Comment 1 Alex Legler (RETIRED) 2009-04-07 06:35:02 UTC]

media-video, looks like .3 is already in CVS, can we go stable?

[Comment 2 Alexis Ballier 2009-04-07 23:56:23 UTC]

(In reply to comment #1)
> media-video, looks like .3 is already in CVS, can we go stable?

yes its ok for stable; its just i've given up on following xine-lib's security status some time ago...

[Comment 3 Alex Legler (RETIRED) 2009-04-08 08:02:48 UTC]

Arches, please test and mark stable:
=media-libs/xine-lib-1.1.16.3
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 sparc x86"

[Comment 4 Brent Baude (RETIRED) 2009-04-08 13:16:34 UTC]

ppc and pcp64 done

[Comment 5 Jeroen Roovers (RETIRED) 2009-04-08 17:01:12 UTC]

Stable for HPPA.

[Comment 6 Tobias Klausmann (RETIRED) 2009-04-08 17:09:22 UTC]

Stable on alpha.

[Comment 7 Tobias Heinlein (RETIRED) 2009-04-08 19:48:18 UTC]

amd64 stable

[Comment 8 Alex Legler (RETIRED) 2009-04-08 20:09:06 UTC]

======================================================
Name: CVE-2009-1274
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1274

Integer overflow in the qt_error parse_trak_atom function in
demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote
attackers to execute arbitrary code via a Quicktime movie file with a
large count value in an STTS atom, which triggers a heap-based buffer
overflow.

[Comment 9 Friedrich Oslage (RETIRED) 2009-04-08 20:29:37 UTC]

sparc stable

[Comment 10 Raúl Porcel (RETIRED) 2009-04-10 13:21:24 UTC]

arm/ia64/x86 stable

[Comment 11 Tobias Heinlein (RETIRED) 2009-04-11 21:01:57 UTC]

GLSA together with bug 234777.

[Comment 12 Alex Legler (RETIRED) 2010-05-30 10:35:20 UTC]

GLSA filed including bug 234777, bug 249041, bug 260069, and bug 265250.

[Comment 13 Alex Legler (RETIRED) 2010-06-01 15:45:30 UTC]

GLSA 201006-04