This GLSA contains notification of vulnerabilities found in several Gentoo packages which have been fixed prior to January 1, 2012. The worst of these vulnerabilities could lead to local privilege escalation and remote code execution. Please see the package list and CVE identifiers below for more information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/syslog-ng | * | < 3.2.4 | >= 3.2.4 |
| app-misc/ca-certificates | * | < 20110502-r1 | >= 20110502-r1 |
| app-office/gnucash | * | < 2.4.4 | >= 2.4.4 |
| dev-db/unixODBC | * | < 2.3.0-r1 | >= 2.3.0-r1 |
| dev-libs/xmlsec | * | < 1.2.17 | >= 1.2.17 |
| dev-php/PEAR-Mail | * | < 1.2.0 | >= 1.2.0 |
| dev-php/PEAR-PEAR | * | < 1.9.2-r1 | >= 1.9.2-r1 |
| dev-util/oprofile | * | < 0.9.6-r1 | >= 0.9.6-r1 |
| dev-util/qt-creator | * | < 2.1.0 | >= 2.1.0 |
| dev-vcs/gitolite | * | < 1.5.9.1 | >= 1.5.9.1 |
| games-sports/racer-bin | * | >= 0.5.0-r1 | — |
| gnome-base/gdm | * | < 3.8.4-r3 | >= 3.8.4-r3 |
| media-libs/fmod | * | < 4.38.00 | >= 4.38.00 |
| media-libs/xine-lib | * | < 1.1.19 | >= 1.1.19 |
| media-sound/lastfmplayer | * | < 1.5.4.26862-r3 | >= 1.5.4.26862-r3 |
| net-analyzer/sflowtool | * | < 3.20 | >= 3.20 |
| net-libs/libsoup | * | < 2.34.3 | >= 2.34.3 |
| net-libs/webkit-gtk | * | < 1.2.7 | >= 1.2.7 |
| net-misc/mrouted | * | < 3.9.5 | >= 3.9.5 |
| net-misc/rsync | * | < 3.0.8 | >= 3.0.8 |
| net-misc/vino | * | < 2.32.2 | >= 2.32.2 |
| sys-apps/shadow | * | < 4.1.4.3 | >= 4.1.4.3 |
| sys-cluster/resource-agents | * | < 1.0.4-r1 | >= 1.0.4-r1 |
| sys-fs/lvm2 | * | < 2.02.72 | >= 2.02.72 |
| x11-apps/xrdb | * | < 1.0.9 | >= 1.0.9 |
For more information on the packages listed in this GLSA, please see their homepage referenced in the ebuild.
Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details.
A context-dependent attacker may be able to gain escalated privileges, execute arbitrary code, cause Denial of Service, obtain sensitive information, or otherwise bypass security restrictions.
There are no known workarounds at this time.
All FMOD Studio users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/fmod-4.38.00"
All PEAR Mail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-php/PEAR-Mail-1.2.0"
All LVM2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/lvm2-2.02.72"
All GnuCash users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-office/gnucash-2.4.4"
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.19"
All Last.fm Scrobbler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-sound/lastfmplayer-1.5.4.26862-r3"
All WebKitGTK+ users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-1.2.7"
All shadow tool suite users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.1.4.3"
All PEAR users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-php/PEAR-PEAR-1.9.2-r1"
All unixODBC users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/unixODBC-2.3.0-r1"
All Resource Agents users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-cluster/resource-agents-1.0.4-r1"
All mrouted users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/mrouted-3.9.5"
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.0.8"
All XML Security Library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/xmlsec-1.2.17"
All xrdb users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-apps/xrdb-1.0.9"
All Vino users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/vino-2.32.2"
All OProfile users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-util/oprofile-0.9.6-r1"
All syslog-ng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/syslog-ng-3.2.4"
All sFlow Toolkit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/sflowtool-3.20"
All GNOME Display Manager users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=gnome-base/gdm-3.8.4-r3"
All libsoup users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/libsoup-2.34.3"
All CA Certificates users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-misc/ca-certificates-20110502-r1"
All Gitolite users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/gitolite-1.5.9.1"
All QtCreator users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-util/qt-creator-2.1.0"
Gentoo has discontinued support for Racer. We recommend that users unmerge Racer:
# emerge --unmerge "games-sports/racer-bin"
NOTE: This is a legacy GLSA. Updates for all affected architectures have been available since 2012. It is likely that your system is already no longer affected by these issues.
Multiple vulnerabilities in xine-lib might result in the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.16.3 | >= 1.1.16.3 |
xine-lib is the core library package for the xine media player, and other players such as Amarok, Codeine/Dragon Player and Kaffeine.
Multiple vulnerabilities have been reported in xine-lib. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to play a specially crafted video file or stream with a player using xine-lib, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All xine-lib users should upgrade to an unaffected version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.16.3"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since April 10, 2009. It is likely that your system is already no longer affected by this issue.
xine-lib is vulnerable to multiple buffer overflows when processing media streams.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.13 | >= 1.1.13 |
xine-lib is the core library package for the xine media player, and other players such as Amarok, Codeine/Dragon Player and Kaffeine.
Multiple vulnerabilities have been discovered in xine-lib:
A remote attacker could entice a user to play a specially crafted video file or stream with a player using xine-lib, potentially resulting in the execution of arbitrary code with the privileges of the user running the player.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.13"
xine-lib is vulnerable to multiple buffer overflows when processing FLAC and ASF streams.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.10.1 | >= 1.1.10.1 |
xine-lib is the core library package for the xine media player.
Damian Frizza and Alfredo Ortega (Core Security Technologies) discovered a stack-based buffer overflow within the open_flac_file() function in the file demux_flac.c when parsing tags within a FLAC file (CVE-2008-0486). A buffer overflow when parsing ASF headers, which is similar to CVE-2006-1664, has also been discovered (CVE-2008-1110).
A remote attacker could entice a user to play specially crafted FLAC or ASF video streams with a player using xine-lib, potentially resulting in the execution of arbitrary code with the privileges of the user running the player.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.10.1"
xine-lib is vulnerable to multiple heap-based buffer overflows when processing RTSP streams.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.9.1 | >= 1.1.9.1 |
xine-lib is the core library package for the xine media player.
Luigi Auriemma reported that xine-lib does not properly check boundaries when processing SDP attributes of RTSP streams, leading to heap-based buffer overflows.
An attacker could entice a user to play specially crafted RTSP video streams with a player using xine-lib, potentially resulting in the execution of arbitrary code with the privileges of the user running the player.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.9.1"
xine-lib is vulnerable to a heap-based buffer overflow.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | x86 | < 1.1.4-r2 | >= 1.1.4-r2 |
xine-lib is the core library package for the xine media player.
xine-lib does not check boundaries on data being read into buffers from DMO video files in code that is shared with MPlayer (DMO_VideoDecoder.c).
An attacker could entice a user to play a specially crafted DMO video file with a player using xine-lib, potentially resulting in the execution of arbitrary code with the privileges of the user running the player.
There is no known workaround at this time.
All xine-lib users on the x86 platform should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.4-r2"
xine-lib is vulnerable to a buffer overflow in the Real Media input plugin, which could lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.2-r3 | >= 1.1.2-r3 |
xine is a portable and reusable multimedia playback engine. xine-lib is xine's core engine.
A possible buffer overflow has been reported in the Real Media input plugin.
An attacker could exploit this vulnerability by enticing a user into loading a specially crafted stream with xine or an application using xine-lib. This can lead to a Denial of Service and possibly the execution of arbitrary code with the rights of the user running the application.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.2-r3"
xine-lib is vulnerable to multiple buffer overflows that could be exploited to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.2-r2 | >= 1.1.2-r2 |
xine is a high performance, portable and reusable multimedia playback engine. xine-lib is xine's core engine.
xine-lib contains buffer overflows in the processing of AVI. Additionally, xine-lib is vulnerable to a buffer overflow in the HTTP plugin (xineplug_inp_http.so) via a long reply from an HTTP server.
An attacker could trigger the buffer overflow vulnerabilities by enticing a user to load a specially crafted AVI file in xine. This might result in the execution of arbitrary code with the rights of the user running xine. Additionally, a remote HTTP server serving a xine client a specially crafted reply could crash xine and possibly execute arbitrary code.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.2-r2"
A buffer overflow has been found in the libmms library shipped with xine-lib, potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.2-r2 | >= 1.1.2-r2 |
xine-lib is the core library of xine, a multimedia player.
There is a stack based overflow in the libmms library included with xine-lib which can be triggered by malicious use of the send_command, string_utf16, get_data and get_media_packet functions.
A remote attacker could design a malicious media file that would trigger the overflow, potentially resulting in the execution of arbitrary code.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.2-r2"
xine-lib contains a buffer overflow vulnerability which may lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.2_pre20060328-r1 | >= 1.1.2_pre20060328-r1 |
xine-lib is the xine core engine. xine is a free multimedia player. It plays CDs, DVDs, and VCDs, and can also decode other common multimedia formats.
Federico L. Bossi Bonin discovered that when handling MPEG streams xine-lib fails to make a proper boundary check of the input data supplied by the user before copying it to an insufficiently sized memory buffer.
A remote attacker could entice a user to play a specially-crafted MPEG file, resulting in the execution of arbitrary code with the permissions of the user running the application.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.2_pre20060328-r1"
xine-lib and FFmpeg are vulnerable to a buffer overflow that may be exploited by attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.1-r3 | >= 1.1.1-r3 |
| media-video/ffmpeg | * | < 0.4.9_p20051216 | >= 0.4.9_p20051216 |
xine is a GPL high-performance, portable and reusable multimedia playback engine. xine-lib is xine's core engine. FFmpeg is a very fast video and audio converter and is used in xine-lib.
Simon Kilvington has reported a vulnerability in FFmpeg libavcodec. The flaw is due to a buffer overflow error in the "avcodec_default_get_buffer()" function. This function doesn't properly handle specially crafted PNG files as a result of a heap overflow.
A remote attacker could entice a user to run an FFmpeg based application on a maliciously crafted PNG file, resulting in the execution of arbitrary code with the permissions of the user running the application.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.1-r3"
All FFmpeg users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-video/ffmpeg-0.4.9_p20051216"
xine-lib contains a format string error in CDDB response handling that may be exploited to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.1.0-r5 | >= 1.1.0-r5, >= 1.0.1-r4 (revision), >= 1_rc8-r2 (revision) |
xine-lib is a multimedia library which can be utilized to create multimedia frontends. It includes functions to retrieve information about audio CD contents from public CDDB servers.
Ulf Harnhammar discovered a format string bug in the routines handling CDDB server response contents.
An attacker could submit malicious information about an audio CD to a public CDDB server (or impersonate a public CDDB server). When the victim plays this CD on a multimedia frontend relying on xine-lib, it could end up executing arbitrary code.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose media-libs/xine-lib
Two vulnerabilities have been found in xine-lib which could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1.0-r2 | >= 1.0-r2, >= 1_rc6-r2 (revision) |
xine-lib is a multimedia library which can be utilized to create multimedia frontends.
Heap overflows have been found in the code handling RealMedia RTSP and Microsoft Media Services streams over TCP (MMST).
By setting up a malicious server and enticing a user to use its streaming data, a remote attacker could possibly execute arbitrary code on the client computer with the permissions of the user running any multimedia frontend making use of the xine-lib library.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose media-libs/xine-lib
xine-lib contains multiple overflows potentially allowing execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1_rc8-r1 | >= 1_rc8-r1, >= 1_rc6-r1 (revision) |
xine-lib is a multimedia library which can be utilized to create multimedia frontends.
Ariel Berkman discovered that xine-lib reads specific input data into an array without checking the input size in demux_aiff.c, making it vulnerable to a buffer overflow (CAN-2004-1300) . iDefense discovered that the PNA_TAG handling code in pnm_get_chunk() does not check if the input size is larger than the buffer size (CAN-2004-1187). iDefense also discovered that in this same function, a negative value could be given to an unsigned variable that specifies the read length of input data (CAN-2004-1188).
A remote attacker could craft a malicious movie or convince a targeted user to connect to a malicious PNM server, which could result in the execution of arbitrary code with the rights of the user running any xine-lib frontend.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose media-libs/xine-lib
xine-lib contains several vulnerabilities potentially allowing the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | <= 1_rc5-r3 | >= 1_rc6 |
xine-lib is a multimedia library which can be utilized to create multimedia frontends.
xine-lib contains two stack-based overflows and one heap-based overflow. In the code reading VCD disc labels, the ISO disc label is copied into an unprotected stack buffer of fixed size. Also, there is a buffer overflow in the code that parses subtitles and prepares them for display (XSA-2004-4). Finally, xine-lib contains a heap-based overflow in the DVD sub-picture decoder (XSA-2004-5).
(Please note that the VCD MRL issue mentioned in XSA-2004-4 was fixed with GLSA 200408-18.)
With carefully-crafted VCDs, DVDs, MPEGs or subtitles, an attacker may cause xine-lib to execute arbitrary code with the permissions of the user.
There is no known workaround at this time.
All xine-lib users should upgrade to the latest version:
# emerge sync # emerge -pv ">=media-libs/xine-lib-1_rc6" # emerge ">=media-libs/xine-lib-1_rc6"
xine-lib contains an exploitable buffer overflow in the VCD handling code
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | <= 1_rc5-r2 | >= 1_rc5-r3 |
xine-lib is a multimedia library which can be utilized to create multimedia frontends.
xine-lib contains a bug where it is possible to overflow the vcd:// input source identifier management buffer through carefully crafted playlists.
An attacker may construct a carefully-crafted playlist file which will cause xine-lib to execute arbitrary code with the permissions of the user. In order to conform with the generic naming standards of most Unix-like systems, playlists can have extensions other than .asx (the standard xine playlist format), and made to look like another file (MP3, AVI, or MPEG for example). If an attacker crafts a playlist with a valid header, they can insert a VCD playlist line that can cause a buffer overflow and possible shellcode execution.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of xine-lib.
All xine-lib users should upgrade to the latest version:
# emerge sync # emerge -pv ">=media-libs/xine-lib-1_rc5-r3" # emerge ">=media-libs/xine-lib-1_rc5-r3"
Multiple vulnerabilities, including remotely exploitable buffer overflows, have been found in code common to MPlayer and the xine library.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | < 1_rc4 | >= 1_rc4, <= 0.9.13-r3 |
| media-video/mplayer | * | < 1.0_pre4 | >= 1.0_pre4, <= 0.92-r1 |
MPlayer is a movie player capable of handling multiple multimedia file formats. xine-lib is a multimedia player library used by several graphical user interfaces, including xine-ui. They both use the same code to handle Real-Time Streaming Protocol (RTSP) streams from RealNetworks servers.
Multiple vulnerabilities have been found and fixed in the RTSP handling code common to recent versions of these two packages. These vulnerabilities include several remotely exploitable buffer overflows.
A remote attacker, posing as a RTSP stream server, can execute arbitrary code with the rights of the user of the software playing the stream (MPlayer or any player using xine-lib). Another attacker may entice a user to use a maliciously crafted URL or playlist to achieve the same results.
For MPlayer, there is no known workaround at this time. For xine-lib, you can delete the xineplug_inp_rtsp.so file.
All users should upgrade to non-vulnerable versions of MPlayer and xine-lib:
# emerge sync # emerge -pv ">=media-video/mplayer-1.0_pre4" # emerge ">=media-video/mplayer-1.0_pre4" # emerge -pv ">=media-libs/xine-lib-1_rc4" # emerge ">=media-libs/xine-lib-1_rc4"
Several vulnerabilities have been found in xine-ui and xine-lib, potentially allowing an attacker to overwrite files with the rights of the user.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/xine-lib | * | <= 1_rc3-r2 | >= 1_rc3-r3 |
| media-video/xine-ui | * | <= 0.9.23-r1 | >= 0.9.23-r2 |
xine is a multimedia player allowing to play back CDs, DVDs, and VCDs and decoding multimedia files like AVI, MOV, WMV, and MP3 from local disk drives, and displays multimedia streamed over the Internet. It is available in Gentoo as a reusable library (xine-lib) with a standard user interface (xine-ui).
Several vulnerabilities were found in xine-ui and xine-lib. By opening a malicious MRL in any xine-lib based media player, an attacker can write arbitrary content to an arbitrary file, only restricted by the permissions of the user running the application. By opening a malicious playlist in the xine-ui media player, an attacker can write arbitrary content to an arbitrary file, only restricted by the permissions of the user running xine-ui. Finally, a temporary file is created in an insecure manner by the xine-check and xine-bugreport scripts, potentially allowing a local attacker to use a symlink attack.
These three vulnerabilities may alow an attacker to corrupt system files, thus potentially leading to a Denial of Service. It is also theoretically possible, though very unlikely, to use these vulnerabilities to elevate the privileges of the attacker.
There is no known workaround at this time. All users are advised to upgrade to the latest available versions of xine-ui and xine-lib.
All users of xine-ui or another xine-based player should upgrade to the latest stable versions:
# emerge sync # emerge -pv ">=media-video/xine-ui-0.9.23-r2" # emerge ">=media-video/xine-ui-0.9.23-r2" # emerge -pv ">=media-libs/xine-lib-1_rc3-r3" # emerge ">=media-libs/xine-lib-1_rc3-r3"