CVE-2005-2967

Format string vulnerability in input_cdda.c in xine-lib 1-beta through 1-beta 3, 1-rc, 1.0...

7.5 HighPublic exploitFix available

Format string vulnerability in input_cdda.c in xine-lib 1-beta through 1-beta 3, 1-rc, 1.0 through 1.0.2, and 1.1.1 allows remote servers to execute arbitrary code via format string specifiers in metadata in CDDB server responses when the victim plays a CD.

Exploit likelihood

9.68%Down 14.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2005-2967
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2005-2967
Updated: 2026-11-02

EUVDEUVD-2005-2967 No score

Record: EUVD-2005-2967
Updated: 2026-11-03

GitHub AdvisoriesGHSA-65qq-9m6q-q3fq No score

Format string vulnerability in input_cdda.c in xine-lib 1-beta through 1-beta 3, 1-rc, 1.0...

Record: GHSA-65qq-9m6q-q3fq
Updated: 2026-11-02

Affected products

xine xine-lib

Affected packages

Affected packages
Package	Affected	Fixed
`xine-lib` Debian:3.0	before 0.9.8-2woody4, plus listed versions 0.9.8-20.9.8-2woody3	0.9.8-2woody4
`xine-lib` Debian:3.1	before 1.0.1-1sarge1, plus listed versions 1.0.1-1	1.0.1-1sarge1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Xine-Lib 1.1 - 'Media Player Library' Remote Format String	2005-10-10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-2967 is a high vulnerability (CVSS 7.5) in Xine Xine-lib, published October 12, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.68%, the 95th percentile. Fixed in xine-lib 0.9.8-2woody4.

References

Show 14 moreShow less