Critical vulnerabilities in xine-lib closed

The Xine developers have released version 1.1.16.3, an update to the free media player that eliminates a security vulnerability. Attackers may be able to create groomed Quicktime movies which can allow for the execution of arbitrary code in the context of an application using the xine library. This requires the victim to view the groomed file with xine-lib based application.

The cause of the problem, according to the report, is an integer overflow which can lead to a heap overflow, allowing an exploit. In the new version of the library, another security problem related to the processing of the proprietary 4X Movie Format (4XM) has also been resolved. That vulnerability was first published in late January by Tobias Klein who discovered it in the FFmpeg library.

See also

• xine-lib Quicktime STTS Atom Integer Overflow, report by Tobias Klein
• xine-lib Quicktime STTS Atom Integer Overflow, bug report of Xine project
• Vulnerability found in FFmpeg library, a report from The H

(djwm)