Joined: 12 May 2004
|Posted: Thu May 26, 2005 11:36 am Post subject: [ GLSA 200505-19 ] gxine: Format string vulnerability
|Gentoo Linux Security Advisory
Title: gxine: Format string vulnerability (GLSA 200505-19)
Date: May 26, 2005
A format string vulnerability in gxine could allow a remote attacker to
execute arbitrary code.
gxine is a GTK+ and xine-lib based media player.
Vulnerable: < 0.4.4
Unaffected: >= 0.3.3-r2 < 0.3.4
Unaffected: >= 0.4.1-r1 < 0.4.2
Unaffected: >= 0.4.4
Architectures: All supported architectures
Exworm discovered that gxine insecurely implements formatted
printing in the hostname decoding function.
A remote attacker could entice a user to open a carefully crafted
file with gxine, possibly leading to the execution of arbitrary code.
There is no known workaround at this time.
All gxine users should upgrade to the latest available version:
|# emerge --sync
# emerge --ask --oneshot --verbose media-video/gxine
Bugtraq ID 13707
Last edited by GLSA on Tue Apr 19, 2011 4:19 am; edited 5 times in total