vendor:
xine-lib
by:
milw0rm.com
7.5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: xine-lib
Affected Version From: 1.1.12
Affected Version To: 1.1.12
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Stack-based Buffer Overflow in the NES Sound Format Demuxer
xine-lib <= 1.1.12 is prone to a stack-based buffer overflow in the NES Sound Format demuxer(demux_nsf.c). The vulnerability is caused due to a boundary error within the open_nsf_file() and demux_nsf_send_chunk() functions when handling a specially crafted NSF file. This can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into opening a malicious NSF file. A proof-of-concept exploit is available.
Mitigation:
Upgrade to xine-lib version 1.1.13 or later.
