Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-0225 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Xine-lib

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer10 documents7 sources
Severity
6.4MEDIUMNVD
EPSS
8.4%
top 7.69%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Xine Xine-lib
Timeline
PublishedJan 10
Latest updateMay 1

Description

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmff_dump_header function and related to disregarding the max field. NOTE: some of these details are obtained from third party information.

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 10.0 | Impact: 4.9

Affected Packages1 packages

â–¶NVDxine/xine-lib1.1.9

🔴Vulnerability Details

2
GHSA
GHSA-552c-gjq7-88rp: Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff↗2022-05-01
â–¶
CVEList
CVE-2008-0225: Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff↗2008-01-10
â–¶

💥Exploits & PoCs

1
Exploit-DB
Xine-Lib 1.1.9 - 'rmff_dump_cont()' Remote Heap Buffer Overflow (PoC)↗2008-01-09
â–¶

📋Vendor Advisories

4
Ubuntu
xine-lib vulnerabilities↗2008-08-06
â–¶
Red Hat
kernel: uvcvideo: Fix a buffer overflow in format descriptor parsing↗2008-07-31
â–¶
Red Hat
xine-lib: SDP attributes buffer overflow↗2008-01-09
â–¶
Red Hat
xine-lib: SDP attributes buffer overflow↗2008-01-08
â–¶

💬Community

2
Bugzilla
CVE-2008-0238 xine-lib: SDP attributes buffer overflow↗2008-01-14
â–¶
Bugzilla
CVE-2008-0225 xine-lib: SDP attributes buffer overflow↗2008-01-14
â–¶
CVE-2008-0225 — Xine Xine-lib vulnerability | cvebase