Description
Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file and "bad indexes", a different vulnerability than CVE-2005-4048 and CVE-2006-2802.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | xine-lib | 1.0.1-1sarge4 | DSA-1215-1 |
Advisories 1
- DSA-1215-1 xine-lib Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200609-09 vendor-advisory
- SUSE-SA:2006:073 vendor-advisory
- 22230 third-party-advisory
- 23010 third-party-advisory
- USN-358-1 vendor-advisory
- 23213 third-party-advisory
- http://xinehq.de/index.php/news
- DSA-1215 vendor-advisory