FishSound Library Remote Speex Decoding Code Execution Vulnerability

Bugtraq ID:	28665
Class:	Boundary Condition Error
CVE:	CVE-2008-1686
Remote:	Yes
Local:	No
Published:	Apr 07 2008 12:00AM
Updated:	Apr 13 2015 09:54PM
Credit:	The original reporter of this issue wishes to remain anonymous.
Vulnerable:	XMMS XMMS speex plugin 0 Xiph.org vorbis-tools 0 Xiph.org Speex 1.1.12 Xiph.org Speex 1.1.11 Xiph.org Speex 1.1.4 Xiph.org Speex 1.2 Xiph.org libvorbis 1.2 Xiph.org libvorbis 1.1.1 Xiph.org libvorbis 1.0.1 xine xine-lib 1.1.11 xine xine-lib 1.1.10 xine xine-lib 1.1.9 .1 xine xine-lib 1.1.9 xine xine-lib 1.1.4 xine xine-lib 1.1.3 xine xine-lib 1.1.2 xine xine-lib 1.1.1 xine xine-lib 1.1 xine xine-lib 1.1.11.1 xine xine-lib 1.1.10.1 VideoLAN VLC media player 0.8.6f Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE SUSE Linux Enterprise SDK 10 SP2 SuSE SUSE Linux Enterprise SDK 10 SP1 SuSE SUSE Linux Enterprise SDK 10 SuSE Suse Linux Enterprise Desktop 10 SP2 SuSE Suse Linux Enterprise Desktop 10 SP1 SuSE Suse Linux Enterprise Desktop 10 SuSE SUSE Linux Enterprise 10 SP1 DEBUGINFO SuSE Linux Openexchange Server SuSE Linux Desktop 1.0 SuSE Linux Desktop 10 SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc SuSE Linux 10.0 x86-64 SuSE Linux 10.0 x86 SuSE Linux 10.0 ppc Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current SDL SDL_sound 0 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. SUSE Linux Enterprise Server RT Solution 10 0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. openSUSE 10.1 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 1 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 10.2 X86 64 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 10.2 X86 64 S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Office Server Redhat Fedora 7 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux 5 Server Redhat Desktop 4.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 illiminable Directshow Filters 0.71.946 Gentoo Linux freedesktop.org GStreamer Good Plug-ins 0 freedesktop.org GStreamer 0.10.7 freedesktop.org GStreamer 0.10.6 freedesktop.org GStreamer 0.10.5 freedesktop.org GStreamer 0.10.3 freedesktop.org GStreamer 0.10 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 CSIRO FishSound 0.9 CSIRO FishSound 0 CSIRO Annodex Plugins for Firefox 0 Conrad Parker Sweep 0.9.2
Not Vulnerable:	xine xine-lib 1.1.12 freedesktop.org GStreamer Good Plug-ins 0.10.8 CSIRO FishSound 0.9.1 Conrad Parker Sweep 0.9.3

FishSound Library Remote Speex Decoding Code Execution Vulnerability

The FishSound 'libfishsound' library is prone to a remote code-execution vulnerability because the software fails to properly bounds-check user-supplied data.

Successfully exploiting this issue allows attackers to execute arbitrary machine code in the context of applications that use the library. Failed exploit attempts likely result in denial-of-service conditions.

Versions prior to FishSound 0.9.1 are vulnerable.

The following applications use the library and are also vulnerable:

- Speex
- Annodex plugin for Firefox
- Illiminable DirectShow Filters
- gstreamer-plugins-good
- SDL_sound
- Sweep
- vorbis-tools
- VLC Media Player
- xine-lib
- XMMS speex plugin

Other applications may also be affected.

FishSound Library Remote Speex Decoding Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FishSound Library Remote Speex Decoding Code Execution Vulnerability

Solution:
Please see the referenced advisories for details on obtaining and applying the appropriate updates.


Ubuntu Ubuntu Linux 7.10 powerpc

• Ubuntu libxine-dev_1.1.7-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.1 .7-1ubuntu1.3_all.deb


• Ubuntu libxine1-console_1.1.7-1ubuntu1.3_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-co nsole_1.1.7-1ubuntu1.3_powerpc.deb


• Ubuntu libxine1-dbg_1.1.7-1ubuntu1.3_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-dbg_1. 1.7-1ubuntu1.3_powerpc.deb


• Ubuntu libxine1-doc_1.1.7-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-doc_1. 1.7-1ubuntu1.3_all.deb


• Ubuntu libxine1-ffmpeg_1.1.7-1ubuntu1.3_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-ff mpeg_1.1.7-1ubuntu1.3_powerpc.deb


• Ubuntu libxine1-gnome_1.1.7-1ubuntu1.3_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-gn ome_1.1.7-1ubuntu1.3_powerpc.deb


• Ubuntu libxine1-plugins_1.1.7-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.7-1ubuntu1.3_all.deb


• Ubuntu libxine1_1.1.7-1ubuntu1.3_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1_1.1.7- 1ubuntu1.3_powerpc.deb

CSIRO FishSound 0

• CSIRO libfishsound-0.9.1.tar.gz
  http://www.annodex.net/software/libfishsound/download/libfishsound-0.9 .1.tar.gz

Debian Linux 4.0 amd64

• Debian libxine1_1.1.2+dfsg-7_amd64.deb
  http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2 +dfsg-7_amd64.deb

Debian Linux 4.0 ia-32

• Debian libxine1_1.1.2+dfsg-7_i386.deb
  http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2 +dfsg-7_i386.deb

Ubuntu Ubuntu Linux 7.04 i386

• Ubuntu libxine-dev_1.1.4-2ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.1 .4-2ubuntu3.1_i386.deb


• Ubuntu libxine-extracodecs_1.1.4-2ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/multiverse/x/xine-lib/libxine-e xtracodecs_1.1.4-2ubuntu3.1_all.deb


• Ubuntu libxine-main1_1.1.4-2ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine-mai n1_1.1.4-2ubuntu3.1_all.deb


• Ubuntu libxine1-console_1.1.4-2ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-co nsole_1.1.4-2ubuntu3.1_i386.deb


• Ubuntu libxine1-dbg_1.1.4-2ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-dbg_1. 1.4-2ubuntu3.1_i386.deb


• Ubuntu libxine1-ffmpeg_1.1.4-2ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-ff mpeg_1.1.4-2ubuntu3.1_i386.deb


• Ubuntu libxine1-gnome_1.1.4-2ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-gn ome_1.1.4-2ubuntu3.1_i386.deb


• Ubuntu libxine1-kde_1.1.4-2ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-kde_1. 1.4-2ubuntu3.1_i386.deb


• Ubuntu libxine1-plugins_1.1.4-2ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.4-2ubuntu3.1_all.deb


• Ubuntu libxine1_1.1.4-2ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1_1.1.4- 2ubuntu3.1_i386.deb

freedesktop.org GStreamer Good Plug-ins 0

• freedesktop.org gstspeexdec.c
  http://webcvs.freedesktop.org/gstreamer/gst-plugins-good/ext/speex/gst speexdec.c?r1=1.40&r2=1.41&view=patch

Debian Linux 4.0 mips

• Debian libxine1_1.1.2+dfsg-7_mips.deb
  http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2 +dfsg-7_mips.deb

Debian Linux 4.0 arm

• Debian libxine1_1.1.2+dfsg-7_arm.deb
  http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2 +dfsg-7_arm.deb

Debian Linux 4.0 powerpc

• Debian libxine1_1.1.2+dfsg-7_powerpc.deb
  http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2 +dfsg-7_powerpc.deb

Ubuntu Ubuntu Linux 7.04 amd64

• Ubuntu libxine-dev_1.1.4-2ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.1 .4-2ubuntu3.1_amd64.deb


• Ubuntu libxine-extracodecs_1.1.4-2ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/multiverse/x/xine-lib/libxine-e xtracodecs_1.1.4-2ubuntu3.1_all.deb


• Ubuntu libxine-main1_1.1.4-2ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine-mai n1_1.1.4-2ubuntu3.1_all.deb


• Ubuntu libxine1-console_1.1.4-2ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-co nsole_1.1.4-2ubuntu3.1_amd64.deb


• Ubuntu libxine1-dbg_1.1.4-2ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-dbg_1. 1.4-2ubuntu3.1_amd64.deb


• Ubuntu libxine1-ffmpeg_1.1.4-2ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-ff mpeg_1.1.4-2ubuntu3.1_amd64.deb


• Ubuntu libxine1-gnome_1.1.4-2ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-gn ome_1.1.4-2ubuntu3.1_amd64.deb


• Ubuntu libxine1-kde_1.1.4-2ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-kde_1. 1.4-2ubuntu3.1_amd64.deb


• Ubuntu libxine1-plugins_1.1.4-2ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.4-2ubuntu3.1_all.deb


• Ubuntu libxine1_1.1.4-2ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1_1.1.4- 2ubuntu3.1_amd64.deb

xine xine-lib 1.1.11.1

• xine xine-lib-1.1.12.tar.bz2
  http://prdownloads.sourceforge.net/xine/xine-lib-1.1.12.tar.bz2

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libxine-dev_1.1.11.1-1ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine-dev_1.1.11.1-1ubu ntu3.1_lpia.deb


• Ubuntu libxine1-all-plugins_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-al l-plugins_1.1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-bin_1.1.11.1-1ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-bin_1.1.11.1-1ub untu3.1_lpia.deb


• Ubuntu libxine1-console_1.1.11.1-1ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-console_1.1.11.1 -1ubuntu3.1_lpia.deb


• Ubuntu libxine1-dbg_1.1.11.1-1ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-dbg_1.1.11.1-1ub untu3.1_lpia.deb


• Ubuntu libxine1-doc_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-doc_1. 1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-ffmpeg_1.1.11.1-1ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/x/xine-lib/libxine1-ffmpeg_1.1.1 1.1-1ubuntu3.1_lpia.deb


• Ubuntu libxine1-gnome_1.1.11.1-1ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/x/xine-lib/libxine1-gnome_1.1.11 .1-1ubuntu3.1_lpia.deb


• Ubuntu libxine1-misc-plugins_1.1.11.1-1ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-misc-plugins_1.1 .11.1-1ubuntu3.1_lpia.deb


• Ubuntu libxine1-plugins_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-x_1.1.11.1-1ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-x_1.1.11.1-1ubun tu3.1_lpia.deb


• Ubuntu libxine1_1.1.11.1-1ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1_1.1.11.1-1ubuntu 3.1_lpia.deb

Ubuntu Ubuntu Linux 7.10 lpia

• Ubuntu libxine-dev_1.1.7-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.1 .7-1ubuntu1.3_all.deb


• Ubuntu libxine1-console_1.1.7-1ubuntu1.3_lpia.deb
  http://ports.ubuntu.com/pool/universe/x/xine-lib/libxine1-console_1.1. 7-1ubuntu1.3_lpia.deb


• Ubuntu libxine1-dbg_1.1.7-1ubuntu1.3_lpia.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-dbg_1.1.7-1ubunt u1.3_lpia.deb


• Ubuntu libxine1-doc_1.1.7-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-doc_1. 1.7-1ubuntu1.3_all.deb


• Ubuntu libxine1-ffmpeg_1.1.7-1ubuntu1.3_lpia.deb
  http://ports.ubuntu.com/pool/universe/x/xine-lib/libxine1-ffmpeg_1.1.7 -1ubuntu1.3_lpia.deb


• Ubuntu libxine1-gnome_1.1.7-1ubuntu1.3_lpia.deb
  http://ports.ubuntu.com/pool/universe/x/xine-lib/libxine1-gnome_1.1.7- 1ubuntu1.3_lpia.deb


• Ubuntu libxine1-plugins_1.1.7-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.7-1ubuntu1.3_all.deb


• Ubuntu libxine1_1.1.7-1ubuntu1.3_lpia.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1_1.1.7-1ubuntu1.3 _lpia.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu libxine-dev_1.1.1+ubuntu2-7.9_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.1 .1+ubuntu2-7.9_i386.deb


• Ubuntu libxine-main1_1.1.1+ubuntu2-7.9_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-main1_1 .1.1+ubuntu2-7.9_i386.deb

Debian Linux 4.0 sparc

• Debian libxine1_1.1.2+dfsg-7_sparc.deb
  http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.1.2 +dfsg-7_sparc.deb

Ubuntu Ubuntu Linux 7.10 amd64

• Ubuntu libxine-dev_1.1.7-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.1 .7-1ubuntu1.3_all.deb


• Ubuntu libxine1-console_1.1.7-1ubuntu1.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-co nsole_1.1.7-1ubuntu1.3_amd64.deb


• Ubuntu libxine1-dbg_1.1.7-1ubuntu1.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-dbg_1. 1.7-1ubuntu1.3_amd64.deb


• Ubuntu libxine1-doc_1.1.7-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-doc_1. 1.7-1ubuntu1.3_all.deb


• Ubuntu libxine1-ffmpeg_1.1.7-1ubuntu1.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-ff mpeg_1.1.7-1ubuntu1.3_amd64.deb


• Ubuntu libxine1-gnome_1.1.7-1ubuntu1.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-gn ome_1.1.7-1ubuntu1.3_amd64.deb


• Ubuntu libxine1-plugins_1.1.7-1ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.7-1ubuntu1.3_all.deb


• Ubuntu libxine1_1.1.7-1ubuntu1.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1_1.1.7- 1ubuntu1.3_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu libxine-dev_1.1.11.1-1ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.1 .11.1-1ubuntu3.1_i386.deb


• Ubuntu libxine1-all-plugins_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-al l-plugins_1.1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-bin_1.1.11.1-1ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-bin_1. 1.11.1-1ubuntu3.1_i386.deb


• Ubuntu libxine1-console_1.1.11.1-1ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-consol e_1.1.11.1-1ubuntu3.1_i386.deb


• Ubuntu libxine1-dbg_1.1.11.1-1ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-dbg_1. 1.11.1-1ubuntu3.1_i386.deb


• Ubuntu libxine1-doc_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-doc_1. 1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-ffmpeg_1.1.11.1-1ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-ff mpeg_1.1.11.1-1ubuntu3.1_i386.deb


• Ubuntu libxine1-gnome_1.1.11.1-1ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-gn ome_1.1.11.1-1ubuntu3.1_i386.deb


• Ubuntu libxine1-misc-plugins_1.1.11.1-1ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-misc-p lugins_1.1.11.1-1ubuntu3.1_i386.deb


• Ubuntu libxine1-plugins_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-x_1.1.11.1-1ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-x_1.1. 11.1-1ubuntu3.1_i386.deb


• Ubuntu libxine1_1.1.11.1-1ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1_1.1.11 .1-1ubuntu3.1_i386.deb

Ubuntu Ubuntu Linux 7.04 powerpc

• Ubuntu libxine-dev_1.1.4-2ubuntu3.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.1 .4-2ubuntu3.1_powerpc.deb


• Ubuntu libxine-extracodecs_1.1.4-2ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/multiverse/x/xine-lib/libxine-e xtracodecs_1.1.4-2ubuntu3.1_all.deb


• Ubuntu libxine-main1_1.1.4-2ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine-mai n1_1.1.4-2ubuntu3.1_all.deb


• Ubuntu libxine1-console_1.1.4-2ubuntu3.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-co nsole_1.1.4-2ubuntu3.1_powerpc.deb


• Ubuntu libxine1-dbg_1.1.4-2ubuntu3.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-dbg_1. 1.4-2ubuntu3.1_powerpc.deb


• Ubuntu libxine1-ffmpeg_1.1.4-2ubuntu3.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-ff mpeg_1.1.4-2ubuntu3.1_powerpc.deb


• Ubuntu libxine1-gnome_1.1.4-2ubuntu3.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-gn ome_1.1.4-2ubuntu3.1_powerpc.deb


• Ubuntu libxine1-kde_1.1.4-2ubuntu3.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-kde_1. 1.4-2ubuntu3.1_powerpc.deb


• Ubuntu libxine1-plugins_1.1.4-2ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.4-2ubuntu3.1_all.deb


• Ubuntu libxine1_1.1.4-2ubuntu3.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1_1.1.4- 2ubuntu3.1_powerpc.deb

SDL SDL_sound 0

• SDL speex.c
  http://svn.icculus.org/SDL_sound/trunk/decoders/speex.c?view=patch&r1= 537&r2=536&pathrev=537

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libxine-dev_1.1.11.1-1ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine-dev_1.1.11.1-1ubu ntu3.1_powerpc.deb


• Ubuntu libxine1-all-plugins_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-al l-plugins_1.1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-bin_1.1.11.1-1ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-bin_1.1.11.1-1ub untu3.1_powerpc.deb


• Ubuntu libxine1-console_1.1.11.1-1ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-console_1.1.11.1 -1ubuntu3.1_powerpc.deb


• Ubuntu libxine1-dbg_1.1.11.1-1ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-dbg_1.1.11.1-1ub untu3.1_powerpc.deb


• Ubuntu libxine1-doc_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-doc_1. 1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-ffmpeg_1.1.11.1-1ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/x/xine-lib/libxine1-ffmpeg_1.1.1 1.1-1ubuntu3.1_powerpc.deb


• Ubuntu libxine1-gnome_1.1.11.1-1ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/x/xine-lib/libxine1-gnome_1.1.11 .1-1ubuntu3.1_powerpc.deb


• Ubuntu libxine1-misc-plugins_1.1.11.1-1ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-misc-plugins_1.1 .11.1-1ubuntu3.1_powerpc.deb


• Ubuntu libxine1-plugins_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-x_1.1.11.1-1ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-x_1.1.11.1-1ubun tu3.1_powerpc.deb


• Ubuntu libxine1_1.1.11.1-1ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1_1.1.11.1-1ubuntu 3.1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libxine-dev_1.1.11.1-1ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine-dev_1.1.11.1-1ubu ntu3.1_sparc.deb


• Ubuntu libxine1-all-plugins_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-al l-plugins_1.1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-bin_1.1.11.1-1ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-bin_1.1.11.1-1ub untu3.1_sparc.deb


• Ubuntu libxine1-console_1.1.11.1-1ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-console_1.1.11.1 -1ubuntu3.1_sparc.deb


• Ubuntu libxine1-dbg_1.1.11.1-1ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-dbg_1.1.11.1-1ub untu3.1_sparc.deb


• Ubuntu libxine1-doc_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine1-doc_1. 1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-ffmpeg_1.1.11.1-1ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/x/xine-lib/libxine1-ffmpeg_1.1.1 1.1-1ubuntu3.1_sparc.deb


• Ubuntu libxine1-gnome_1.1.11.1-1ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/x/xine-lib/libxine1-gnome_1.1.11 .1-1ubuntu3.1_sparc.deb


• Ubuntu libxine1-misc-plugins_1.1.11.1-1ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-misc-plugins_1.1 .11.1-1ubuntu3.1_sparc.deb


• Ubuntu libxine1-plugins_1.1.11.1-1ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/x/xine-lib/libxine1-pl ugins_1.1.11.1-1ubuntu3.1_all.deb


• Ubuntu libxine1-x_1.1.11.1-1ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1-x_1.1.11.1-1ubun tu3.1_sparc.deb


• Ubuntu libxine1_1.1.11.1-1ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/x/xine-lib/libxine1_1.1.11.1-1ubuntu 3.1_sparc.deb

xine xine-lib 1.1.1

• xine xine-lib-1.1.12.tar.bz2
  http://prdownloads.sourceforge.net/xine/xine-lib-1.1.12.tar.bz2

xine xine-lib 1.1.11

• xine xine-lib-1.1.12.tar.bz2
  http://prdownloads.sourceforge.net/xine/xine-lib-1.1.12.tar.bz2

xine xine-lib 1.1.2

• xine xine-lib-1.1.12.tar.bz2
  http://prdownloads.sourceforge.net/xine/xine-lib-1.1.12.tar.bz2

xine xine-lib 1.1.4

• xine xine-lib-1.1.12.tar.bz2
  http://prdownloads.sourceforge.net/xine/xine-lib-1.1.12.tar.bz2

xine xine-lib 1.1.9 .1

• xine xine-lib-1.1.12.tar.bz2
  http://prdownloads.sourceforge.net/xine/xine-lib-1.1.12.tar.bz2

xine xine-lib 1.1.9

• xine xine-lib-1.1.12.tar.bz2
  http://prdownloads.sourceforge.net/xine/xine-lib-1.1.12.tar.bz2

FishSound Library Remote Speex Decoding Code Execution Vulnerability

References:

• [Speex-dev] libfishsound 0.9.1 Release (Conrad Parker)
  
• Annodex Plugins for Firefox Project Page (CSIRO)
  
• Directshow Filters for Ogg Vorbis, Speex, Theora and FLAC Project Page (illiminable)
  
• FishSound Project Page (CSIRO)
  
• GStreamer Good Plug-ins Home Page (freedesktop.org)
  
• Release Name: 1.1.12 (xine)
  
• SDL_sound Home Page (SDL)
  
• Speex: A Free Codec For Free Speech (Xiph.org)
  
• Sweep Home Page (Conrad Parker)
  
• Vendor Home Page (xine)
  
• VLC Homepage (VideoLAN)
  
• [oCERT-2008-004] multiple speex implementations insufficient boundary checks (Andrea Barisani )
  
• #2008-002 libfishsound insufficient boundary checks (oCERT)
  
• #2008-004 multiple speex implementations insufficient boundary checks (oCERT)
  
• RHSA-2008:0235-4 - Important: speex security update (Red Hat)