diff options
| author | Matthias Hopf <mhopf@suse.de> | 2009-01-04 17:21:46 +0000 |
|---|---|---|
| committer | Matthias Hopf <mhopf@suse.de> | 2009-01-04 17:21:46 +0000 |
| commit | ba5f2ab8d7209f3971ecf22ea3bc5ee43a692b5c (patch) | |
| tree | a79d6e7a0b55fd40bdb0942909f45f036f03f2df /TODO | |
| parent | 0c51806592bae19fbc4f1f6615e5b3f4cb8e7dc3 (diff) | |
| download | xine-lib-ba5f2ab8d7209f3971ecf22ea3bc5ee43a692b5c.tar.gz xine-lib-ba5f2ab8d7209f3971ecf22ea3bc5ee43a692b5c.tar.bz2 | |
Fix for CVE-2008-5240
xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an
untrusted input value to determine the memory allocation and does not
check the result for (1) the MATROSKA_ID_TR_CODECPRIVATE track entry
element processed by demux_matroska.c; and (2) PROP_TAG, (3) MDPR_TAG,
and (4) CONT_TAG chunks processed by the real_parse_headers function
in demux_real.c; which allows remote attackers to cause a denial of
service (NULL pointer dereference and crash) or possibly execute
arbitrary code via a crafted value.
Diffstat (limited to 'TODO')
0 files changed, 0 insertions, 0 deletions