Kaffeine: Buffer overflow — GLSA 200604-04

Kaffeine is vulnerable to a buffer overflow that could lead to the execution of arbitrary code.

Affected packages

Package	media-video/kaffeine on all architectures
Affected versions	< 0.7.1-r2
Unaffected versions	>= 0.7.1-r2

Background

Kaffeine is a graphical front-end for the xine-lib multimedia library.

Description

Kaffeine uses an unchecked buffer when fetching remote RAM playlists via HTTP.

Impact

A remote attacker could entice a user to play a specially-crafted RAM playlist resulting in the execution of arbitrary code with the permissions of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All Kaffeine users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-video/kaffeine-0.7.1-r2"

References

CVE-2006-0051
KDE Security Advisory: Kaffeine buffer overflow

Release date
April 05, 2006

Latest revision
April 05, 2006: 01

Severity
normal

Exploitable
remote

Bugzilla entries

127326