Xine Errors.C Remote Format String Vulnerability

Bugtraq ID:	22002
Class:	Input Validation Error
CVE:	CVE-2007-0254
Remote:	Yes
Local:	No
Published:	Jan 11 2007 12:00AM
Updated:	Aug 10 2007 06:54PM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	xine xine-ui 0.99.4 xine xine-ui 0 SuSE Linux 9.3 SuSE Linux 10.1 SuSE Linux 10.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 Gentoo Linux
Not Vulnerable:

Xine Errors.C Remote Format String Vulnerability

The 'xine' media player is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application and to compromise affected computers.

The xine-ui branch is vulnerable; other branches may also be affected.

Xine Errors.C Remote Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Xine Errors.C Remote Format String Vulnerability

Solution:
Please see the referenced advisories for more information.

Xine Errors.C Remote Format String Vulnerability

References:

• xine Homepage (xine)
  
• Xine-ui format string Vulnerabilties. ([email protected] )