製品・ソフトウェアに関する情報

JVN脆弱性詳細

xine-lib における脆弱性

Title	xine-lib における脆弱性
Summary	xine-lib は、必要な長さを確定する前に V4L ビデオフレーム事前割り当てを実行する、および src/input/input_v4l.c の open_video_capture_device 関数内にバッファオーバーフローの不備があるため、不特定の影響を受ける脆弱性が存在します。
Possible impacts	不特定の影響を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 25, 2008, midnight
Registration Date	Dec. 20, 2012, 6:52 p.m.
Last Update	Dec. 20, 2012, 6:52 p.m.

CVSS2.0 : 危険
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected System

Xine

xine-lib 1.1.15 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-5245	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5245
National Vulnerability Database (NVD)
2	CVE-2008-5245	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5245

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Xine
1	Release Name: 1.1.15	http://sourceforge.net/project/shownotes.php?release_id=619869

Change Log

No	Changed Details	Date of change
0	[2012年12月20日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2008-5245

Summary	xine-lib before 1.1.15 performs V4L video frame preallocation before ascertaining the required length, which has unknown impact and attack vectors, possibly related to a buffer overflow in the open_video_capture_device function in src/input/input_v4l.c.
Publication Date	Nov. 26, 2008, 10:30 a.m.
Registration Date	Jan. 29, 2021, 1:45 p.m.
Last Update	Aug. 8, 2017, 10:33 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:xine:xine-lib:0.9.13:::::::*
cpe:2.3:a:xine:xine-lib:1:rc0a::::::
cpe:2.3:a:xine:xine-lib:1:rc1::::::
cpe:2.3:a:xine:xine-lib:1:rc2::::::
cpe:2.3:a:xine:xine-lib:1:rc3::::::
cpe:2.3:a:xine:xine-lib:1:rc3a::::::
cpe:2.3:a:xine:xine-lib:1:rc3b::::::
cpe:2.3:a:xine:xine-lib:1:rc3c::::::
cpe:2.3:a:xine:xine-lib:1:rc4::::::
cpe:2.3:a:xine:xine-lib:1:rc4a::::::
cpe:2.3:a:xine:xine-lib:1:rc5::::::
cpe:2.3:a:xine:xine-lib:1:rc6a::::::
cpe:2.3:a:xine:xine-lib:1:rc7::::::
cpe:2.3:a:xine:xine-lib:1:rc8::::::
cpe:2.3:a:xine:xine-lib:1.0:::::::*
cpe:2.3:a:xine:xine-lib:1.0.1:::::::*
cpe:2.3:a:xine:xine-lib:1.0.2:::::::*
cpe:2.3:a:xine:xine-lib:1.0.3a:::::::*
cpe:2.3:a:xine:xine-lib:1.1.0:::::::*
cpe:2.3:a:xine:xine-lib:1.1.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.2:::::::*
cpe:2.3:a:xine:xine-lib:1.1.3:::::::*
cpe:2.3:a:xine:xine-lib:1.1.4:::::::*
cpe:2.3:a:xine:xine-lib:1.1.5:::::::*
cpe:2.3:a:xine:xine-lib:1.1.6:::::::*
cpe:2.3:a:xine:xine-lib:1.1.7:::::::*
cpe:2.3:a:xine:xine-lib:1.1.8:::::::*
cpe:2.3:a:xine:xine-lib:1.1.9:::::::*
cpe:2.3:a:xine:xine-lib:1.1.9.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.10:::::::*
cpe:2.3:a:xine:xine-lib:1.1.10.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.11:::::::*
cpe:2.3:a:xine:xine-lib:1.1.11.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.12:::::::*
cpe:2.3:a:xine:xine-lib:1.1.13:::::::*
cpe:2.3:a:xine:xine-lib::::::::		1.1.14
cpe:2.3:a:xine:xine-lib:1_beta1:::::::*
cpe:2.3:a:xine:xine-lib:1_beta2:::::::*
cpe:2.3:a:xine:xine-lib:1_beta3:::::::*
cpe:2.3:a:xine:xine-lib:1_beta4:::::::*
cpe:2.3:a:xine:xine-lib:1_beta5:::::::*
cpe:2.3:a:xine:xine-lib:1_beta6:::::::*
cpe:2.3:a:xine:xine-lib:1_beta7:::::::*
cpe:2.3:a:xine:xine-lib:1_beta8:::::::*
cpe:2.3:a:xine:xine-lib:1_beta9:::::::*
cpe:2.3:a:xine:xine-lib:1_beta10:::::::*
cpe:2.3:a:xine:xine-lib:1_beta11:::::::*
cpe:2.3:a:xine:xine-lib:1_beta12:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html	SUSE
2	http://secunia.com/advisories/31502	SECUNIA	Vendor Advisory
3	http://securitytracker.com/id?1020703	SECTRACK
4	http://sourceforge.net/project/shownotes.php?release_id=619869	CONFIRM
5	http://www.mandriva.com/security/advisories?name=MDVSA-2009:020	MANDRIVA
6	http://www.securityfocus.com/bid/30698	BID
7	http://www.vupen.com/english/advisories/2008/2382	VUPEN
8	https://exchange.xforce.ibmcloud.com/vulnerabilities/44470	XF

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:xine:xine-lib:0.9.13:::::::*
cpe:2.3:a:xine:xine-lib:1:rc0a::::::
cpe:2.3:a:xine:xine-lib:1:rc1::::::
cpe:2.3:a:xine:xine-lib:1:rc2::::::
cpe:2.3:a:xine:xine-lib:1:rc3::::::
cpe:2.3:a:xine:xine-lib:1:rc3a::::::
cpe:2.3:a:xine:xine-lib:1:rc3b::::::
cpe:2.3:a:xine:xine-lib:1:rc3c::::::
cpe:2.3:a:xine:xine-lib:1:rc4::::::
cpe:2.3:a:xine:xine-lib:1:rc4a::::::
cpe:2.3:a:xine:xine-lib:1:rc5::::::
cpe:2.3:a:xine:xine-lib:1:rc6a::::::
cpe:2.3:a:xine:xine-lib:1:rc7::::::
cpe:2.3:a:xine:xine-lib:1:rc8::::::
cpe:2.3:a:xine:xine-lib:1.0:::::::*
cpe:2.3:a:xine:xine-lib:1.0.1:::::::*
cpe:2.3:a:xine:xine-lib:1.0.2:::::::*
cpe:2.3:a:xine:xine-lib:1.0.3a:::::::*
cpe:2.3:a:xine:xine-lib:1.1.0:::::::*
cpe:2.3:a:xine:xine-lib:1.1.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.2:::::::*
cpe:2.3:a:xine:xine-lib:1.1.3:::::::*
cpe:2.3:a:xine:xine-lib:1.1.4:::::::*
cpe:2.3:a:xine:xine-lib:1.1.5:::::::*
cpe:2.3:a:xine:xine-lib:1.1.6:::::::*
cpe:2.3:a:xine:xine-lib:1.1.7:::::::*
cpe:2.3:a:xine:xine-lib:1.1.8:::::::*
cpe:2.3:a:xine:xine-lib:1.1.9:::::::*
cpe:2.3:a:xine:xine-lib:1.1.9.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.10:::::::*
cpe:2.3:a:xine:xine-lib:1.1.10.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.11:::::::*
cpe:2.3:a:xine:xine-lib:1.1.11.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.12:::::::*
cpe:2.3:a:xine:xine-lib:1.1.13:::::::*
cpe:2.3:a:xine:xine-lib::::::::		1.1.14
cpe:2.3:a:xine:xine-lib:1_beta1:::::::*
cpe:2.3:a:xine:xine-lib:1_beta2:::::::*
cpe:2.3:a:xine:xine-lib:1_beta3:::::::*
cpe:2.3:a:xine:xine-lib:1_beta4:::::::*
cpe:2.3:a:xine:xine-lib:1_beta5:::::::*
cpe:2.3:a:xine:xine-lib:1_beta6:::::::*
cpe:2.3:a:xine:xine-lib:1_beta7:::::::*
cpe:2.3:a:xine:xine-lib:1_beta8:::::::*
cpe:2.3:a:xine:xine-lib:1_beta9:::::::*
cpe:2.3:a:xine:xine-lib:1_beta10:::::::*
cpe:2.3:a:xine:xine-lib:1_beta11:::::::*
cpe:2.3:a:xine:xine-lib:1_beta12:::::::*