Unscored severity · published Jan 10, 2005
CVE-2004-1188
The pnm_get_chunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the…
–
CVSS
2%
EPSS
No
On KEV
Description
The pnm_get_chunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the PREAMBLE_SIZE, which causes a read operation with a negative length that leads to a buffer overflow via (1) RMF_TAG, (2) DATA_TAG, (3) PROP_TAG, (4) MDPR_TAG, and (5) CONT_TAG values, a different vulnerability than CVE-2004-1187.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Mandrake Linux · Mandrakesoft
10.0; 10.0; 10.1; 10.1 · source: NVD
MP
Mplayer · Mplayer
0.90; 0.90_pre; 0.90_rc; 0.90_rc4; 0.91; 0.92; +11 more · source: NVD
XI
Xine · Xine
0.9.8; 0.9.13; 0.9.18; 1_alpha; 1_beta1; 1_beta2; +23 more · source: NVD
XI
Xine-lib · Xine
0.9.8; 0.9.13; 0.99; 1_alpha; 1_beta1; 1_beta2; +22 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1188
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1188
cvs.sourceforge.net
http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/input/pnm.c?r1=1.20&r2=1.21
Patch
http://www.idefense.com/application/poi/display?id=177&type=vulnerabilities
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDKSA-2005:011
www.mplayerhq.hu
http://www.mplayerhq.hu/MPlayer/patches/pnm_fix_20041215.diff
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/18638
More from Mandrake Linux
9.8
CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges
5.5
CVE-2002-1713
The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow local users to read…
–
CVE-2008-0595
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls,…
–
CVE-2007-6284
The xmlCurrentChar function in libxml2 before 2.6.31 allows context-dependent attackers to cause a denial of service (infinite loop) via XML containing invalid UTF-8 sequences
–
CVE-2007-0454
Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in…