| Vulnerability Name: | CVE-2004-1476 (CCN-17431) | ||||||||
| Assigned: | 2004-09-17 | ||||||||
| Published: | 2004-09-17 | ||||||||
| Updated: | 2017-07-11 | ||||||||
| Summary: | Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label. | ||||||||
| CVSS v3 Severity: | 5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2004-1476 Source: CCN Type: SourceForge.net CVS Repository cvs: xine/xine-lib/src/input/vcd/xineplug_inp_vcd.c Source: CCN Type: SECTRACK ID: 1011336 xine-lib VideoCD Buffer Overflows Let Remote Users Execute Arbitrary Code Source: CCN Type: slackware-security Mailing List, Wed, 22 Sep 2004 13:39:28 -0700 (PDT) [slackware-security] xine-lib (SSA:2004-266-04) Source: CCN Type: GLSA-200409-30 xine-lib: Multiple vulnerabilities Source: GENTOO Type: Patch, Vendor Advisory GLSA-200409-30 Source: CCN Type: OSVDB ID: 10042 xine-lib VideoCD ISO Disk Label Parsing Remote Overflow Source: BUGTRAQ Type: Patch, Vendor Advisory 20040907 XSA-2004-4: multiple string overflows Source: BID Type: Patch 11206 Source: CCN Type: BID-11206 Xine-lib VideoCD And Text Subtitle Stack Overflow Vulnerabilities Source: CCN Type: xine Web site xine - A Free Video Player Source: CCN Type: xine-Project Download Web page Download and install xine-lib Source: CONFIRM Type: Patch, Vendor Advisory http://xinehq.de/index.php/security/XSA-2004-4 Source: XF Type: UNKNOWN xine-videocd-disk-bo(17431) Source: XF Type: UNKNOWN xine-videocd-disk-bo(17431) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||