Unrated severityNVD Advisory· Published Apr 8, 2009· Updated Apr 23, 2026
CVE-2009-1274
CVE-2009-1274
Description
Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow.
Affected products
12cpe:2.3:a:xine:xine-lib:1.1.0:*:*:*:*:*:*:*+ 11 more
- cpe:2.3:a:xine:xine-lib:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.16.1:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1.1.16.2:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
17- bugs.xine-project.org/show_bug.cginvdExploit
- www.trapkit.de/advisories/TKADV2009-005.txtnvdExploit
- secunia.com/advisories/34593nvdVendor Advisory
- www.vupen.com/english/advisories/2009/0937nvdVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlnvd
- osvdb.org/53288nvd
- secunia.com/advisories/34712nvd
- secunia.com/advisories/35416nvd
- sourceforge.net/project/shownotes.phpnvd
- www.mandriva.com/security/advisoriesnvd
- www.mandriva.com/security/advisoriesnvd
- www.securityfocus.com/archive/1/502481/100/0/threadednvd
- www.securityfocus.com/bid/34384nvd
- www.securitytracker.com/idnvd
- exchange.xforce.ibmcloud.com/vulnerabilities/49714nvd
- www.redhat.com/archives/fedora-package-announce/2009-April/msg00210.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-April/msg00215.htmlnvd
News mentions
0No linked articles in our index yet.