Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2008-1686

Overview

Vulnerability Score 9.3 9.3
CVE Id CVE-2008-1686
Last Modified 19 May 2011 12:00:00
Published 08 Apr 2008 02:05:00
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity MEDIUM
Authentication NONE

CVE-2008-1686

Summary

Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.

Vulnerable Systems

Application

  • Xine-lib 0.9.13

  • Xine-lib 0.9.8

  • Xine-lib 0.99

  • Xine-lib 1.0

  • Xine-lib 1.0.1

  • Xine-lib 1.0.2

  • Xine-lib 1.0.3a

  • Xine-lib 1.1.0

  • Xine-lib 1.1.1

  • Xine-lib 1.1.10

  • Xine-lib 1.1.10.1

  • Xine-lib 1.1.11

  • Xine-lib 1.1.11.1

  • Xiph Libfishsound 0.5.41

  • Xiph Libfishsound 0.5.42

  • Xiph Libfishsound 0.6.0

  • Xiph Libfishsound 0.6.1

  • Xiph Libfishsound 0.6.2

  • Xiph Libfishsound 0.6.3

  • Xiph Libfishsound 0.7.0

  • Xiph Libfishsound 0.8.0

  • Xiph Libfishsound 0.8.1

  • Xiph Libfishsound 0.9.0

  • Xiph Speex 1.0.2

  • Xiph Speex 1.0.3

  • Xiph Speex 1.0.4

  • Xiph Speex 1.0.5

  • Xiph Speex 1.1.1

  • Xiph Speex 1.1.10

  • Xiph Speex 1.1.11

  • Xiph Speex 1.1.11.1

  • Xiph Speex 1.1.12

  • Xiph Speex 1.1.2

  • Xiph Speex 1.1.3

  • Xiph Speex 1.1.4

  • Xiph Speex 1.1.5

  • Xiph Speex 1.1.6

  • Xiph Speex 1.1.7

  • Xiph Speex 1.1.8

  • Xiph Speex 1.1.9


References

BID - 28665

DEBIAN - DSA-1585

DEBIAN - DSA-1584

FEDORA - FEDORA-2008-3191

FEDORA - FEDORA-2008-3103

FEDORA - FEDORA-2008-3059

XF - fishsound-libfishsound-speex-bo(41684)

VUPEN - ADV-2008-1302

VUPEN - ADV-2008-1301

VUPEN - ADV-2008-1300

VUPEN - ADV-2008-1269

VUPEN - ADV-2008-1268

VUPEN - ADV-2008-1228

VUPEN - ADV-2008-1187

UBUNTU - USN-635-1

UBUNTU - USN-611-3

UBUNTU - USN-611-2

UBUNTU - USN-611-1

SECTRACK - 1019875

BUGTRAQ - 20080417 [oCERT-2008-004] multiple speex implementations insufficientboundary checks

REDHAT - RHSA-2008:0235

MISC - http://www.ocert.org/advisories/ocert-2008-2.html

MISC - http://www.ocert.org/advisories/ocert-2008-004.html

SUSE - SUSE-SR:2008:013

CONFIRM - http://www.metadecks.org/software/sweep/news.html

MANDRIVA - MDVSA-2008:124

MANDRIVA - MDVSA-2008:094

MANDRIVA - MDVSA-2008:093

MANDRIVA - MDVSA-2008:092

DEBIAN - DSA-1586

CONFIRM - http://sourceforge.net/project/shownotes.php?release_id=592185&group_id=9655

CONFIRM - http://sourceforge.net/project/shownotes.php?release_id=592185

SLACKWARE - SSA:2008-111-01

GENTOO - GLSA-200804-17

SECUNIA - 31393

SECUNIA - 30717

SECUNIA - 30581

SECUNIA - 30358

SECUNIA - 30353

SECUNIA - 30337

SECUNIA - 30119

SECUNIA - 30117

SECUNIA - 30104

SECUNIA - 29898

SECUNIA - 29882

SECUNIA - 29881

SECUNIA - 29880

SECUNIA - 29878

SECUNIA - 29866

SECUNIA - 29854

SECUNIA - 29845

SECUNIA - 29835

SECUNIA - 29727

SECUNIA - 29672

MLIST - [Speex-dev] 20080406 libfishsound 0.9.1 Release

SUSE - SUSE-SR:2008:012

CONFIRM - http://blog.kfish.org/2008/04/release-libfishsound-091.html

Related Patches

Novell SUSE 2008:5185 gstreamer010-plugins-good security update for SLE 10 SP1 i586


Last Updated: 27 May 2016 10:47:37