Every CVE Search/ Get API key

CVE-2008-0225

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1...

6.4 MediumPublic exploitFix available

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmff_dump_header function and related to disregarding the max field. NOTE: some of these details are obtained from third party information.

Exploit likelihood

15.0%Down 33.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.4

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmff_dump_header function and related to disregarding the max field. NOTE: some of these details are obtained from third party information.

Record
CVE-2008-0225
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmff_dump_header function and related to disregarding the max field. NOTE: some of these details are obtained from third party information.

Record
CVE-2008-0225
Updated
2026-11-02
EUVDEUVD-2008-0237 No score

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmff_dump_header function and related to disregarding the max field. NOTE: some of these details are obtained from third party information.

Record
EUVD-2008-0237
Updated
2026-11-03
GitHub AdvisoriesGHSA-552c-gjq7-88rp No score

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1...

Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmff_dump_header function and related to disregarding the max field. NOTE: some of these details are obtained from third party information.

Record
GHSA-552c-gjq7-88rp
Weakness
CWE-119
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xine-lib
Debian:4.0
 before 1.1.2+dfsg-5, plus listed versions
1.1.2+dfsg-4
1.1.2+dfsg-5
xine-lib
Debian:3.1
 before 1.0.1-1sarge6, plus listed versions
1.0.1-11.0.1-1sarge11.0.1-1sarge21.0.1-1sarge31.0.1-1sarge41.0.1-1sarge5
1.0.1-1sarge6
xine-lib
Debian:5.0
 before 1.1.8-3+lenny1
1.1.8-3+lenny1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBXine-Lib 1.1.9 - 'rmff_dump_cont()' Remote Heap Buffer Overflow (PoC)2008-01-09

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-0225 is a medium vulnerability (CVSS 6.4) in Xine Xine-lib, published January 10, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 15.0%, the 96th percentile. Fixed in xine-lib 1.1.2+dfsg-5.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open