Debian Bug report logs - #507184
xine-lib: CVE-2008-5246 heap overflow

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Nico Golde <nion@debian.org>
To: submit@bugs.debian.org
Subject: xine-lib: CVE-2008-5246 heap overflow
Date: Fri, 28 Nov 2008 23:11:29 +0100

[Message part 1 (text/plain, inline)]

Package: xine-lib
Severity: grave
Tags: security patch

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for xine-lib.

CVE-2008-5246[0]:
| Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow
| remote attackers to execute arbitrary code via vectors that send ID3
| data to the (1) id3v22_interp_frame and (2) id3v24_interp_frame
| functions in src/demuxers/id3.c.  NOTE: the provenance of this
| information is unknown; the details are obtained solely from third
| party information.


Your upstream fix:
http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=268c1c1639d7;style=gitweb

Btw a rather strange way to fix an integer overflow + a 
strange comment.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] CVE-2008-5246">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5246
    CVE-2008-5246">http://security-tracker.debian.net/tracker/CVE-2008-5246

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 507184-done@bugs.debian.org (full text, mbox):

From: sean finney <seanius@debian.org>
To: 507184-done@bugs.debian.org
Subject: already fixed in testing/unstable
Date: Fri, 26 Dec 2008 19:47:12 +0100

[Message part 1 (text/plain, inline)]

Version: 1.1.14-3

hi,

this bug was fixed in the august upload of the package:

xine-lib (1.1.14-3) unstable; urgency=high

  * More security fixes from upstream hg:
==> - Fix an exploitable ID3 heap buffer overflow.
    - Check for possible buffer overflow attempts in the Real demuxer.
    - Use size_t for data length variables where there may be int overflows.
    - Add some checks for memory allocation failures.

i've verified that the patch is applied.  

a note to the package maintainer: please consider using some form of
patch management system as it's quite difficult to investigate such
problems and/or prepare fixes for them.

i'll investigate the remaining xine-lib security bugs to see if the
same applies.  if time permits i'll also look at what the situation is
with stable, though my focus right now is on squishing lenny/rc bugs.


	sean

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.