xine-lib (SSA:2008-111-01)
Posted on: 04/22/2008 10:25 AM
New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues.
An overflow was found in the Speex decoder that could lead to a crash or possible execution of arbitrary code. Xine-lib lt;= 1.1.12 was also found to be vulnerable to a stack-based buffer overflow in the NES demuxer (thanks to milw0rm.com).
More details about the first issue may be found in the Common Vulnerabilities and Exposures (CVE) database:
Here are the details from the Slackware 12.0 ChangeLog: +--------------------------+ patches/packages/xine-lib-1.1.11.1-i686-3_slack12.0.tgz: Recompiled, with --without-speex (we didn't ship the speex library in Slackware anyway, but for reference this issue would be CVE-2008-1686), and with --disable-nosefart (the recently reported as insecurely demuxed NSF format). As before in -2, this package fixes the two regressions mentioned in the release notes for xine-lib-1.1.12: http://sourceforge.net/project/shownotes.php?release_id=592185group_id=9655 (* Security fix *) +--------------------------+
Where to find the new packages: +-----------------------------+
HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading directly from ftp.slackware.com.
Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating additional FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you.