CVE-2008-5240

Published Nov 26, 2008 CVSS 2.0 · 4.3 Medium EPSS 4.2% KEV · Not listed
Description
xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the memory allocation and does not check the result for (1) the MATROSKA_ID_TR_CODECPRIVATE track entry element processed by demux_matroska.c; and (2) PROP_TAG, (3) MDPR_TAG, and (4) CONT_TAG chunks processed by the real_parse_headers function in demux_real.c; which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) or possibly execute arbitrary code via a crafted value.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2008-5217 xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the memory allocation and does not check the result for (1) the MATROSKA_ID_TR_CODECPRIVATE track entry element processed by demux_matroska.c; and (2) PROP_TAG, (3) MDPR_TAG, and (4) CONT_TAG chunks processed by the real_parse_headers function in demux_real.c; which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) or possibly execute arbitrary code via a crafted value.
Ubuntu USN Ubuntu USN USN-710-1 xine-lib vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 10:49 AM
Reserved
Nov 25, 2008, 12:00 AM
Status
Modified
Published
Nov 26, 2008, 1:30 AM
Modified
Jun 16, 2026, 10:59 PM