CVE-2008-1110

Publication date 29 February 2008

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Buffer overflow in demuxers/demux_asf.c (aka the ASF demuxer) in the xineplug_dmx_asf.so plugin in xine-lib before 1.1.10 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a crafted ASF header. NOTE: this issue leads to a crash when an attack uses the CVE-2006-1664 exploit code, but it is different from CVE-2006-1664.

Read the notes from the security team

Status

Package Ubuntu Release Status
xine-lib 8.04 LTS hardy
Not affected
7.10 gutsy
Fixed 1.1.7-1ubuntu1.3
7.04 feisty
Fixed 1.1.4-2ubuntu3.1
6.10 edgy Ignored end of life, was needed
6.06 LTS dapper
Not affected

Notes

jdstrand

according to http://xinehq.de/index.php/security, 1.1.2 and earlier are not affected PoC http://milw0rm.com/exploits/1641

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
xine-lib

References

Related Ubuntu Security Notices (USN)

    • USN-635-1
    • xine-lib vulnerabilities
    • 6 August 2008

Other references