In association with heise online

07 April 2009, 09:25

Critical vulnerabilities in xine-lib closed

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

The Xine developers have released version 1.1.16.3, an update to the free media player that eliminates a security vulnerability. Attackers may be able to create groomed Quicktime movies which can allow for the execution of arbitrary code in the context of an application using the xine library. This requires the victim to view the groomed file with xine-lib based application.

The cause of the problem, according to the report, is an integer overflow which can lead to a heap overflow, allowing an exploit. In the new version of the library, another security problem related to the processing of the proprietary 4X Movie Format (4XM) has also been resolved. That vulnerability was first published in late January by Tobias Klein who discovered it in the FFmpeg library.

See also

(djwm)

Print Version | Send by email | Permalink: http://h-online.com/-741055
 


  • July's Community Calendar





The H Open

The H Security

The H Developer

The H Internet Toolkit