Vulnerability in Xine Xine-lib

CVE-2008-0073

Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.

EPSS: 0.092 (94.8th percentile) — read the EPSS interpretation.

Affected products

Xine Xine-lib — versions 1.1.10.1
Redhat Fedora — versions 8
N/a — versions n/a

Weakness classification (CWE)

CWE-189

References

PSIRT-CNA@flexerasoftware.com (x_refsource_MISC, Vendor Advisory)
PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_DEBIAN)
PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_GENTOO)
PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_SLACKWARE)
PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_BID)
PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_XF)
PSIRT-CNA@flexerasoftware.com (x_refsource_CONFIRM)
PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_FEDORA)
PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_SUSE)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, third-party-advisory)