CVE-2004-1476 Memory corruption in n/a
Attackers can execute arbitrary code by tricking users into opening a malicious VideoCD file with an unterminated disk label in xine-lib.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2004-1476?
CVE-2004-1476 is a medium-severity memory corruption vulnerability in Suse Suse Linux, published on 13 Feb 2005. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label.
Which versions are affected by CVE-2004-1476?
It affects 3 products.
Products include Suse Suse Linux, Xine Xine, Xine Xine-Lib.
How do I fix CVE-2004-1476?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2004-1476 being exploited?
There is no known exploitation of CVE-2004-1476 in the wild and no public exploit code.
Other vulnerabilities in Suse Suse Linux
- CVE-2007-0460 Memory corruption in n/a
- CVE-2005-2023 The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pi
- CVE-2004-2004 The Live CD in SUSE LINUX 9.1 Personal edition is configured without a password for root, which allows remote attackers to gain privileges via SSH.
- CVE-2000-1040 Denial of service in n/a
- CVE-2000-1044 Memory corruption in n/a
Sources
Also known as DEBIAN-CVE-2004-1476, GHSA-7fcw-5hqr-7p5h.