CVE-2004-1476
CVE-2004-1476 is a medium-severity vulnerability in Xine with a CVSS 2.0 base score of 5.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.1)
- EPSS exploit prediction: 2% (81st percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Xine
- Published:
- Last modified:
Description
Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label.
Frequently asked questions
- What is CVE-2004-1476?
- Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label.
- How severe is CVE-2004-1476?
- CVE-2004-1476 has a CVSS 2.0 base score of 5.1, rated medium severity.
- Is CVE-2004-1476 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2004-1476?
- CVE-2004-1476 primarily affects Xine. In total, 17 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2004-1476?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2004-1476 published?
- CVE-2004-1476 was published on 2004-12-31 and last updated on 2026-06-16.
References
- http://www.gentoo.org/security/en/glsa/glsa-200409-30.xml
- http://www.securityfocus.com/archive/1/375485/2004-09-02/2004-09-08/0
- http://www.securityfocus.com/bid/11206
- http://xinehq.de/index.php/security/XSA-2004-4
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17431
Affected products (17)
- cpe:2.3:a:xine:xine:0.9.18:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1_rc2:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1_rc3:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1_rc4:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine:1_rc5:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:0.99:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1_rc2:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1_rc3:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1_rc4:*:*:*:*:*:*:*
- cpe:2.3:a:xine:xine-lib:1_rc5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:8.2:*:personal:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.0:*:personal:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.0:*:x86_64:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.1:*:personal:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.2:*:personal:*:*:*:*:*
More vulnerabilities in Xine
- CVE-2008-5237 — Critical (CVSS 10.0): Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a…
- CVE-2004-1188 — Critical (CVSS 10.0): The pnm_get_chunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does…
- CVE-2004-1187 — Critical (CVSS 10.0): Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use…
- CVE-2008-5236 — Critical (CVSS 9.3): Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers…
- CVE-2008-5235 — Critical (CVSS 9.3): Heap-based buffer overflow in the demux_real_send_chunk function in src/demuxers/demux_real.c in xine-lib before 1.1.15…
- CVE-2007-0255 — Critical (CVSS 9.3): XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute…