Debians sikkerhedsbulletin

DSA-1586-1 xine-lib -- flere sårbarheder

Rapporteret den:

22. maj 2008

Berørte pakker:

xine-lib

Sårbar:

Referencer i sikkerhedsdatabaser:

I Mitres CVE-ordbog: CVE-2008-1482, CVE-2008-1686, CVE-2008-1878.

Yderligere oplysninger:

Flere sårbarheder er opdaget i xine-lib, et bibliotek der leverer det meste af applikationsfunktionaliteten i multimediaafspilleren xine. Projektet Common Vulnerabilities and Exposures har fundet frem til følgende tre problemer:

CVE-2008-1482
Heltalsoverløbssårbarheder fandtes i xines FLV-, QuickTime-, RealMedia-, MVE- og CAK-demuxere, for uden EBML-fortolkeren der anvendes af Matroska-demuxeren. Disse svagheder gjorde det muligt for en angriber at få heapbuffere til at løbe over, og potentielt udføre vilkårlig kode ved at levere en ondsindet fremstillet fil af disse typer.
CVE-2008-1686
Utilstrækkelig fornuftighedskontrol af inddata i Speex-implementeringen anvendt af denne version af xine, gjorde det muligt at tilgå ugyldige arrays og udføre vilkårlig kode ved at levere en ondsindet fremstillet Speex-fil.
CVE-2008-1878
Utilstrækkelig grænsekontrol i NES Sound Format-demuxeren (NSF) gjorde det muligt at iværksætte stakbufferoverløb og udføre vilkårlig kode gennem en ondsindet fremstillet NSF-fil.

I den stabile distribution (etch), er disse problemer rettet i version 1.1.2+dfsg-7.

I den ustabile distribution (sid), er disse problemer rettet i version 1.1.12-2.

Vi anbefaler at du opgraderer dine xine-lib-pakker.

Rettet i:

Debian GNU/Linux 4.0 (etch)

Kildekode:: http://security.debian.org/pool/updates/main/x/xine-lib/xine-lib_1.1.2+dfsg.orig.tar.gz; http://security.debian.org/pool/updates/main/x/xine-lib/xine-lib_1.1.2+dfsg-7.diff.gz; http://security.debian.org/pool/updates/main/x/xine-lib/xine-lib_1.1.2+dfsg-7.dsc
Alpha:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_alpha.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_alpha.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_alpha.deb
AMD64:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_amd64.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_amd64.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_amd64.deb
ARM:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_arm.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_arm.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_arm.deb
HP Precision:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_hppa.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_hppa.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_hppa.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_i386.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_i386.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_ia64.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_ia64.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_ia64.deb
Big-endian MIPS:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_mips.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_mips.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_mips.deb
Little-endian MIPS:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_mipsel.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_mipsel.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_powerpc.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_powerpc.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_s390.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_s390.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2+dfsg-7_sparc.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.1.2+dfsg-7_sparc.deb; http://security.debian.org/pool/updates/main/x/xine-lib/libxine1-dbg_1.1.2+dfsg-7_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.