Description
XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of CVE-2007-0017.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | xine-ui | No fix yet | — |
| Ubuntu 26.04 LTS | xine-ui | No fix yet | — |
| Ubuntu 25.10 | xine-ui | No fix yet | — |
| Ubuntu 24.04 LTS | xine-ui | No fix yet | — |
| Ubuntu 22.04 LTS | xine-ui | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | xine-ui | No fix yet | — |
| Ubuntu 18.04 LTS | xine-ui | No fix yet | — |
| Ubuntu 16.04 LTS | xine-ui | No fix yet | — |
References
- 22252 vdb-entry
- 20070110 VLC Format String Vulnerability also in XINE mailing-list
- 23931 third-party-advisory
- MDKSA-2007:154 vendor-advisory
- 31666 vdb-entry
- MDKSA-2007:027 vendor-advisory