[ GLSA 201006-04 ] xine-lib: User-assisted execution of arbitrary code

[GLSA]

Gentoo Linux Security Advisory

Title: xine-lib: User-assisted execution of arbitrary code (GLSA 201006-04)
Severity: normal
Exploitable: remote
Date: June 01, 2010
Bug(s): #234777, #249041, #260069, #265250
ID: 201006-04

Synopsis


Multiple vulnerabilities in xine-lib might result in the remote execution
of arbitrary code.


Background


xine-lib is the core library package for the xine media player, and
other players such as Amarok, Codeine/Dragon Player and Kaffeine.


Affected Packages

Package: media-libs/xine-lib
Vulnerable: < 1.1.16.3
Unaffected: >= 1.1.16.3
Architectures: All supported architectures


Description


Multiple vulnerabilities have been reported in xine-lib. Please review
the CVE identifiers referenced below for details.


Impact


A remote attacker could entice a user to play a specially crafted video
file or stream with a player using xine-lib, potentially resulting in
the execution of arbitrary code with the privileges of the user running
the application.


Workaround


There is no known workaround at this time.


Resolution


All xine-lib users should upgrade to an unaffected version: