Description
Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcdio | 0.69 | — |
| Debian 13 | libcdio | 0.69 | — |
| Debian 12 | libcdio | 0.69 | — |
References
- 11206 vdb-entry
- http://xinehq.de/index.php/security/XSA-2004-4
- 20040907 XSA-2004-4: multiple string overflows mailing-list
- GLSA-200409-30 vendor-advisory
- xine-videocd-disk-bo(17431) vdb-entry