CVE-2009-0698: xine xine-lib Numeric Errors

EPSS trend

Probability

3.63%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

0.00 pp

From 3.63% on 21-09-2026

21-09-202621-10-2026

EPSS score

3.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

9 links

www.ubuntu.com/usn/USN-746-1Vendor AdvisoryX Refsource UBUNTU
www.mandriva.com/security/advisories?name=MDVSA-2009:299Vendor AdvisoryX Refsource MANDRIVA
exchange.xforce.ibmcloud.com/vulnerabilities/48954VDB EntryX Refsource XF
sourceforge.net/project/shownotes.php?release_id=660071X Refsource CONFIRMPatch
bugs.xine-project.org/show_bug.cgi?id=205X Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2009:298Vendor AdvisoryX Refsource MANDRIVA
lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.htmlVendor AdvisoryX Refsource SUSE
www.trapkit.de/advisories/TKADV2009-004.txtX Refsource MISC
www.securityfocus.com/archive/1/500514/100/0/threadedMailing ListX Refsource BUGTRAQ

Related vulnerabilities

CVE-2008-5246xinexine-lib5.69%17y ago26-11-2008 01:00Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22_interp_frame and (2) id3v24_interp_frame functions in src/demuxers/id3.c. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.CVE-2008-5233xinexine-lib3.35%17y ago26-11-2008 01:00xine-lib 1.1.12, and other versions before 1.1.15, does not check for failure of malloc in circumstances including (1) the mymng_process_header function in demux_mng.c, (2) the open_mod_file function in demux_mod.c, and (3) frame_buffer allocation in the real_parse_audio_specific_data function in demux_real.c, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.CVE-2008-5243xinexine-lib1.80%17y ago26-11-2008 01:00The real_parse_headers function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input length value to "reindex into an allocated buffer," which allows remote attackers to cause a denial of service (crash) via a crafted value, probably an array index error.CVE-2008-5241xinexine-lib1.80%17y ago26-11-2008 01:00Integer underflow in demux_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allows remote attackers to cause a denial of service (crash) via a crafted media file that results in a small value of moov_atom_size in a compressed MOV (aka CMOV_ATOM).CVE-2008-5245xinexine-lib1.75%17y ago26-11-2008 01:00xine-lib before 1.1.15 performs V4L video frame preallocation before ascertaining the required length, which has unknown impact and attack vectors, possibly related to a buffer overflow in the open_video_capture_device function in src/input/input_v4l.c.CVE-2008-5240xinexine-lib4.19%17y ago26-11-2008 01:00xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the memory allocation and does not check the result for (1) the MATROSKA_ID_TR_CODECPRIVATE track entry element processed by demux_matroska.c; and (2) PROP_TAG, (3) MDPR_TAG, and (4) CONT_TAG chunks processed by the real_parse_headers function in demux_real.c; which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) or possibly execute arbitrary code via a crafted value.

All vulnerabilities inxine-lib

CVE-2009-0698: xine xine-lib Numeric Errors

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References