Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

xine-lib may crash on malformed audio data

CVE-2008-5247 · published 17 years ago
Summary

Versions of xine-lib up to 1.1.15 can be forced to divide by zero when they process specially crafted audio streams. This can cause the application to stop working, effectively a denial of service. Upgrade to a newer version of xine-lib or apply the available patch to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
xine xine-lib <= 1.1.15
0.9.13
1
1.0.1
1.0.2
1.0.3a
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
24 more version ranges
cpe:2.3:a:xine:xine-lib:*:*:*:*:*:*:*:*
Original advisory text
The real_parse_audio_specific_data function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, uses an untrusted height (aka codec_data_length) value as a divisor, which all...
The real_parse_audio_specific_data function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, uses an untrusted height (aka codec_data_length) value as a divisor, which allow remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero value.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-189Numeric Errors
Timeline
Published26 Nov 2008
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-5247 · NVD
Track software like this
Free during beta