NVD Vulnerability Detail

CVE-2008-5246

Summary	Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22_interp_frame and (2) id3v24_interp_frame functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Publication Date	Nov. 26, 2008, 10:30 a.m.
Registration Date	Jan. 29, 2021, 1:45 p.m.
Last Update	Aug. 8, 2017, 10:33 a.m.

CVSS2.0 : HIGH
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	はい
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:xine:xine-lib:0.9.13:::::::*
cpe:2.3:a:xine:xine-lib:1:rc0a::::::
cpe:2.3:a:xine:xine-lib:1:rc1::::::
cpe:2.3:a:xine:xine-lib:1:rc2::::::
cpe:2.3:a:xine:xine-lib:1:rc3::::::
cpe:2.3:a:xine:xine-lib:1:rc3a::::::
cpe:2.3:a:xine:xine-lib:1:rc3b::::::
cpe:2.3:a:xine:xine-lib:1:rc3c::::::
cpe:2.3:a:xine:xine-lib:1:rc4::::::
cpe:2.3:a:xine:xine-lib:1:rc4a::::::
cpe:2.3:a:xine:xine-lib:1:rc5::::::
cpe:2.3:a:xine:xine-lib:1:rc6a::::::
cpe:2.3:a:xine:xine-lib:1:rc7::::::
cpe:2.3:a:xine:xine-lib:1:rc8::::::
cpe:2.3:a:xine:xine-lib:1.0:::::::*
cpe:2.3:a:xine:xine-lib:1.0.1:::::::*
cpe:2.3:a:xine:xine-lib:1.0.2:::::::*
cpe:2.3:a:xine:xine-lib:1.0.3a:::::::*
cpe:2.3:a:xine:xine-lib:1.1.0:::::::*
cpe:2.3:a:xine:xine-lib:1.1.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.2:::::::*
cpe:2.3:a:xine:xine-lib:1.1.3:::::::*
cpe:2.3:a:xine:xine-lib:1.1.4:::::::*
cpe:2.3:a:xine:xine-lib:1.1.5:::::::*
cpe:2.3:a:xine:xine-lib:1.1.6:::::::*
cpe:2.3:a:xine:xine-lib:1.1.7:::::::*
cpe:2.3:a:xine:xine-lib:1.1.8:::::::*
cpe:2.3:a:xine:xine-lib:1.1.9:::::::*
cpe:2.3:a:xine:xine-lib:1.1.9.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.10:::::::*
cpe:2.3:a:xine:xine-lib:1.1.10.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.11:::::::*
cpe:2.3:a:xine:xine-lib:1.1.11.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.12:::::::*
cpe:2.3:a:xine:xine-lib:1.1.13:::::::*
cpe:2.3:a:xine:xine-lib::::::::		1.1.14
cpe:2.3:a:xine:xine-lib:1_beta1:::::::*
cpe:2.3:a:xine:xine-lib:1_beta2:::::::*
cpe:2.3:a:xine:xine-lib:1_beta3:::::::*
cpe:2.3:a:xine:xine-lib:1_beta4:::::::*
cpe:2.3:a:xine:xine-lib:1_beta5:::::::*
cpe:2.3:a:xine:xine-lib:1_beta6:::::::*
cpe:2.3:a:xine:xine-lib:1_beta7:::::::*
cpe:2.3:a:xine:xine-lib:1_beta8:::::::*
cpe:2.3:a:xine:xine-lib:1_beta9:::::::*
cpe:2.3:a:xine:xine-lib:1_beta10:::::::*
cpe:2.3:a:xine:xine-lib:1_beta11:::::::*
cpe:2.3:a:xine:xine-lib:1_beta12:::::::*

Related information, measures and tools

No	URL	refsource
1	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html	SUSE
2	http://osvdb.org/47677	OSVDB
3	http://securitytracker.com/id?1020703	SECTRACK
4	http://sourceforge.net/project/shownotes.php?release_id=619869	CONFIRM
5	http://www.mandriva.com/security/advisories?name=MDVSA-2009:020	MANDRIVA
6	http://www.securityfocus.com/bid/30698	BID
7	http://www.vupen.com/english/advisories/2008/2382	VUPEN
8	https://exchange.xforce.ibmcloud.com/vulnerabilities/44468	XF

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

xine-lib におけるヒープベースのバッファオーバーフローの脆弱性

Title	xine-lib におけるヒープベースのバッファオーバーフローの脆弱性
Summary	xine-lib には、ヒープベースのバッファオーバーフローの脆弱性が存在します。
Possible impacts	第三者により、src/demuxers/id3.c 内の (1) id3v22_interp_frame および (2) id3v24_interp_frame 関数への ID3 データ送信する経路を介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 25, 2008, midnight
Registration Date	Dec. 20, 2012, 6:52 p.m.
Last Update	Dec. 20, 2012, 6:52 p.m.

Affected System

Xine

xine-lib 1.1.15 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-5246	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5246
National Vulnerability Database (NVD)
2	CVE-2008-5246	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5246

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Xine
1	Release Name: 1.1.15	http://sourceforge.net/project/shownotes.php?release_id=619869

Change Log

No	Changed Details	Date of change
0	[2012年12月20日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:xine:xine-lib:0.9.13:::::::*
cpe:2.3:a:xine:xine-lib:1:rc0a::::::
cpe:2.3:a:xine:xine-lib:1:rc1::::::
cpe:2.3:a:xine:xine-lib:1:rc2::::::
cpe:2.3:a:xine:xine-lib:1:rc3::::::
cpe:2.3:a:xine:xine-lib:1:rc3a::::::
cpe:2.3:a:xine:xine-lib:1:rc3b::::::
cpe:2.3:a:xine:xine-lib:1:rc3c::::::
cpe:2.3:a:xine:xine-lib:1:rc4::::::
cpe:2.3:a:xine:xine-lib:1:rc4a::::::
cpe:2.3:a:xine:xine-lib:1:rc5::::::
cpe:2.3:a:xine:xine-lib:1:rc6a::::::
cpe:2.3:a:xine:xine-lib:1:rc7::::::
cpe:2.3:a:xine:xine-lib:1:rc8::::::
cpe:2.3:a:xine:xine-lib:1.0:::::::*
cpe:2.3:a:xine:xine-lib:1.0.1:::::::*
cpe:2.3:a:xine:xine-lib:1.0.2:::::::*
cpe:2.3:a:xine:xine-lib:1.0.3a:::::::*
cpe:2.3:a:xine:xine-lib:1.1.0:::::::*
cpe:2.3:a:xine:xine-lib:1.1.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.2:::::::*
cpe:2.3:a:xine:xine-lib:1.1.3:::::::*
cpe:2.3:a:xine:xine-lib:1.1.4:::::::*
cpe:2.3:a:xine:xine-lib:1.1.5:::::::*
cpe:2.3:a:xine:xine-lib:1.1.6:::::::*
cpe:2.3:a:xine:xine-lib:1.1.7:::::::*
cpe:2.3:a:xine:xine-lib:1.1.8:::::::*
cpe:2.3:a:xine:xine-lib:1.1.9:::::::*
cpe:2.3:a:xine:xine-lib:1.1.9.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.10:::::::*
cpe:2.3:a:xine:xine-lib:1.1.10.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.11:::::::*
cpe:2.3:a:xine:xine-lib:1.1.11.1:::::::*
cpe:2.3:a:xine:xine-lib:1.1.12:::::::*
cpe:2.3:a:xine:xine-lib:1.1.13:::::::*
cpe:2.3:a:xine:xine-lib::::::::		1.1.14
cpe:2.3:a:xine:xine-lib:1_beta1:::::::*
cpe:2.3:a:xine:xine-lib:1_beta2:::::::*
cpe:2.3:a:xine:xine-lib:1_beta3:::::::*
cpe:2.3:a:xine:xine-lib:1_beta4:::::::*
cpe:2.3:a:xine:xine-lib:1_beta5:::::::*
cpe:2.3:a:xine:xine-lib:1_beta6:::::::*
cpe:2.3:a:xine:xine-lib:1_beta7:::::::*
cpe:2.3:a:xine:xine-lib:1_beta8:::::::*
cpe:2.3:a:xine:xine-lib:1_beta9:::::::*
cpe:2.3:a:xine:xine-lib:1_beta10:::::::*
cpe:2.3:a:xine:xine-lib:1_beta11:::::::*
cpe:2.3:a:xine:xine-lib:1_beta12:::::::*