PatchTheCVExine-lib vulnerabilities and fixes
Recent CVEs affecting xine-lib, with upgrade or downgrade steps. 14 tracked.
Also searched as: xine lib.
xine-lib has 14 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 11. Most recent: 2009-04-08. Highest priority: CVE-2008-5246 (score 56/100).
- CVE-2009-1274 MEDIUM 5.0 DOWNGRADE Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earl
- CVE-2009-0698 HIGH 7.5 DOWNGRADE Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cau
- CVE-2008-5248 MEDIUM 4.3 UPGRADE xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via "MP3 files with metada
- CVE-2008-5247 MEDIUM 4.3 UPGRADE The real_parse_audio_specific_data function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier v
- CVE-2008-5246 HIGH 9.3 UPGRADE Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary cod
- CVE-2008-5245 HIGH 9.3 UPGRADE xine-lib before 1.1.15 performs V4L video frame preallocation before ascertaining the required length, which h
- CVE-2008-5244 HIGH 10.0 UPGRADE Unspecified vulnerability in xine-lib before 1.1.15 has unknown impact and attack vectors related to libfaad
- CVE-2008-5243 MEDIUM 4.3 UPGRADE The real_parse_headers function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, rel
- CVE-2008-5242 MEDIUM 6.8 UPGRADE demux_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not validate the count field before
- CVE-2008-5241 MEDIUM 4.3 UPGRADE Integer underflow in demux_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allows remote attac
- CVE-2008-5240 MEDIUM 4.3 UPGRADE xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the me
- CVE-2008-5239 MEDIUM 4.3 DOWNGRADE xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not properly handle (a) negative and (b) zero val
- CVE-2008-5234 HIGH 9.3 UPGRADE Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attack
- CVE-2008-5233 MEDIUM 4.3 UPGRADE xine-lib 1.1.12, and other versions before 1.1.15, does not check for failure of malloc in circumstances inclu
FAQ
How do I fix xine-lib vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xine-lib being exploited right now?
None of the tracked xine-lib CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xine-lib CVE should I patch first?
CVE-2008-5246 currently ranks highest (56/100): Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary cod.