Description
Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow.
References
- 34593 third-party-advisory
- 20090404 [TKADV2009-005] xine-lib Quicktime STTS Atom Integer Overflow mailing-list
- 1021989 vdb-entry
- 53288 vdb-entry
- http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=673233
- SUSE-SR:2009:011 vendor-advisory
- MDVSA-2009:299 vendor-advisory
- FEDORA-2009-3428 vendor-advisory
- xinelib-demuxqt-bo(49714) vdb-entry
- 34384 vdb-entry
- 35416 third-party-advisory
- MDVSA-2009:298 vendor-advisory
- FEDORA-2009-3433 vendor-advisory
- 34712 third-party-advisory
- ADV-2009-0937 vdb-entry
- http://bugs.xine-project.org/show_bug.cgi?id=224
- http://www.trapkit.de/advisories/TKADV2009-005.txt