CVE-2008-1482 Integer overflow in n/a
Remote attackers can execute arbitrary code by tricking users into opening crafted media files processed by the xine-lib library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2008-1482?
CVE-2008-1482 is a medium-severity vulnerability in n/a, published on 24 Mar 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via (1) a crafted .FLV file, which triggers an overflow in demuxers/demux_flv.c; (2) a crafted .MOV file, which triggers an overflow in demuxers/demux_qt.c; (3) a crafted .RM file, which triggers an overflow in demuxers/demux_real.c; (4) a crafted .MVE file, which triggers an overflow in demuxers/demux_wc3movie.c; (5) a crafted .MKV file, which triggers an overflow in demuxers/ebml.c; or (6) a crafted .CAK file, which triggers an overflow in demuxers/demux_film.c.
Which versions are affected by CVE-2008-1482?
It affects 1 product.
Products include Xine Xine-Lib.
How do I fix CVE-2008-1482?
Upgrade to a fixed version.
Is CVE-2008-1482 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-1482 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DTSA-120-1, GHSA-7vf8-639x-9hxv.