Bug 438663 (CVE-2008-1482)

Summary:	CVE-2008-1482 xine-lib Integer overflow flaws
Product:	[Other] Security Response	Reporter:	Lubomir Kundrak <lkundrak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gauret, rdieter, ville.skytta
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://bugs.gentoo.org/show_bug.cgi?id=214270
Whiteboard:
Fixed In Version:	1.1.11.1-1.fc8	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-04-09 05:17:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	438669, 438670, 438671
Bug Blocks:

Description Lubomir Kundrak 2008-03-24 10:31:25 UTC

Multiple buffer overflow flaws were discovered in xine-lib.

The vulnerabilities are caused due to integer overflow errors when
allocating memory in src/demuxers/demux_flv.c,
src/demuxers/demux_qt.c, src/demuxers/demux_real.c,
src/demuxers/demux_wc3movie.c, src/demuxers/ebml.c, and
src/demuxers/demux_film.c. These can be exploited to cause heap-based
buffer overflows via overly large fields included in e.g. FLV, MOV,
RM, MVE, MKV, and CAK files.

See original advisory for details:

http://aluigi.altervista.org/adv/xinehof-adv.txt

Gentoo:

FWIW, they should _all_ be fixed in 1.2 series, I suppose backporting the
relevant changes, if possible, would solve the issue. 1.2 makes good use of
calloc rather than using malloc directly.

Comment 1 Lubomir Kundrak 2008-03-24 10:36:45 UTC

CVE name was requested.

Comment 3 Kurt Seifried 2008-03-25 00:58:06 UTC

CVE-2008-1482

Comment 4 Lubomir Kundrak 2008-03-27 21:51:39 UTC

http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=a3f2772fd14b57e0557ef45797ff04c768657a7e;style=gitweb

Comment 5 Ville Skyttä 2008-03-30 16:58:22 UTC

I'm working on updating F-8+ to 1.1.11.1 which should fix this issue.

Comment 6 Fedora Update System 2008-03-30 19:56:52 UTC

xine-lib-1.1.11.1-1.fc8 has been submitted as an update for Fedora 8

Comment 7 Fedora Update System 2008-04-01 21:35:55 UTC

xine-lib-1.1.11.1-1.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update xine-lib'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F8/FEDORA-2008-2849

Comment 8 Ville Skyttä 2008-04-02 05:17:32 UTC

FWIW, it was not my intention to push this to testing but directly to stable,
but once again I could not convince Bodhi to do that.

Comment 9 Fedora Update System 2008-04-06 08:59:51 UTC

xine-lib-1.1.11.1-1.fc7 has been submitted as an update for Fedora 7

Comment 10 Fedora Update System 2008-04-09 05:16:29 UTC

xine-lib-1.1.11.1-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2008-04-09 05:17:30 UTC

xine-lib-1.1.11.1-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.