Ubuntu Security Notice USN-196-1
10th October, 2005
xine-lib vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 5.04
- Ubuntu 4.10
Details
Ulf Harnhammar discovered a format string vulnerability in the CDDB
module's cache file handling in the Xine library, which is
used by packages such as xine-ui, totem-xine, and gxine.
By tricking an user into playing a particular audio CD which has a
specially-crafted CDDB entry, a remote attacker could exploit this
vulnerability to execute arbitrary code with the privileges of the
user running the application. Since CDDB servers usually allow anybody
to add and modify information, this exploit does not even require a
particular CDDB server to be selected.
Update instructions
The problem can be corrected by updating your system to the following package version:
- Ubuntu 5.04:
- libxine1
- Ubuntu 4.10:
- libxine1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
None