Issues the date: 2008-08-22
Renewal date: 2008-08-26

Is affected the system:
xine xine-lib <= 1.1.14
Not affected system:
xine xine-lib 1.1.15
Description:
--------------------------------------------------------------------------------
BUGTRAQ ID: 30797

xine is a section of free media player, supports many kinds of forms.

xine-lib storehouse when analysis abnormal media file has many buffer overflow crack, the permission long-distance aggressor carries out the random code.

1) src/demuxers/demux_realaudio.c in the document open_ra_file() function has the integer overflow crack, if the user were deceived opens the specially made RealAudio document to trigger this overflow on the possibility.

2) src/demuxers/demux_matroska.c in the document parse_block_group() function exists piles the overflow crack, if the user were deceived opens the specially made Matroska document to trigger this overflow on the possibility.

<* origin: Will Drewry (wad@google.com)
 
  Link: http://secunia.com/advisories/31567/
        http://marc.info/?l=bugtraq&m=121943981105339&w=2
*>

Suggested:
--------------------------------------------------------------------------------
Manufacturer patch:

xine
----
At present the manufacturer had already issued the promotion patch repairs this security problem, welcome to manufacturer main page downloading:

http://downloads.sourceforge.net/xine/xine-lib-1.1.15.tar.bz2?modtime=1218753637&big_mirror=0