Unrated severityNVD Advisory· Published Nov 26, 2008· Updated Apr 23, 2026
CVE-2008-5237
CVE-2008-5237
Description
Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) crafted width and height values that are not validated by the mymng_process_header function in demux_mng.c before use in an allocation calculation or (2) crafted current_atom_size and string_size values processed by the parse_reference_atom function in demux_qt.c for an RDRF_ATOM string.
Affected products
39cpe:2.3:a:xine:xine:*:*:*:*:*:*:*:*+ 38 more
- cpe:2.3:a:xine:xine:*:*:*:*:*:*:*:*range: <=1.1.5
- cpe:2.3:a:xine:xine:0.9.13:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.0.3a:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.1.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.1.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta1:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta10:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta11:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta12:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta2:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta3:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta4:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta5:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta6:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta7:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta8:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:beta9:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc0a:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc1:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc2:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc3:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc3a:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc3b:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc3c:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc4:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc4a:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc5:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc6a:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc7:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1:rc8:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
12- lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlnvd
- secunia.com/advisories/31827nvd
- secunia.com/advisories/33544nvd
- securityreason.com/securityalert/4648nvd
- www.mandriva.com/security/advisoriesnvd
- www.ocert.org/analysis/2008-008/analysis.txtnvd
- www.securityfocus.com/archive/1/495674/100/0/threadednvd
- www.securityfocus.com/bid/30797nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/44652nvd
- www.redhat.com/archives/fedora-package-announce/2008-September/msg00174.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2008-September/msg00385.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-January/msg00555.htmlnvd
News mentions
0No linked articles in our index yet.