CVE-2008-5237

N/A

Published: November 26, 2008 at 01:00 AM UTC

Updated: June 16, 2026 at 10:59 PM UTC

1 product affected across 1 vendorXine

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 6%

Description

Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) crafted width and height values that are not validated by the mymng_process_header function in demux_mng.c before use in an allocation calculation or (2) crafted current_atom_size and string_size values processed by the parse_reference_atom function in demux_qt.c for an RDRF_ATOM string.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Xine · Xine

95%

v ≤ 1.1.50.9.131 beta11 beta101 beta111 beta121 beta21 beta31 beta41 beta51 beta61 beta71 beta81 beta91 rc0a1 rc11 rc21 rc31 rc3a1 rc3b1 rc3c1 rc41 rc4a1 rc51 rc6a1 rc71 rc81.0 1.0.1 1.0.2 1.0.3a 1.1.0 1.1.1 1.1.10.1 1.1.11 1.1.11.1 1.1.2 1.1.3 1.1.4