Download xine 1.1.12

Xine is an open source multimedia player that can play CDs, DVDs and VCDs. In addition, the program likes avi, mov, wmv, and mp3 files, as well as multimedia streams from the internet. The program works on Linux, Freebsd, Solaris, Irix and Mac OS X, among others. The developers have released another member of the 1.1 series, this time with 1.1.12 as the version number. The list of changes since the previous entry on the Meuktracker looks like this:

Version 1.1.12:

• security fixes:
  • Insufficient boundary check in speex audio decoder. (CVE-2008-1686)
• Fixed and improved the PulseAudio driver.
• Fixed a regression in 1.1.11.1 which broke Quicktime container handling.
• And another, this time in the Matroska demuxer.
• Added a tool to assist with generating front ends’ desktop files. It lists MIME types & filename extensions known to the installed xine-lib.
• Various Real codec improvements, including:
  • RV20 no longer causes segfaults (observed on amd64);
  • Cook is now handled by ffmpeg.
• Added a video output plugin intended for passing raw data to the front end.

Version 1.1.11.1:

• security fixes:
  • Integer overflows in FLV, Qt, Real, WC3Movie, Matroska and FILM demuxers, allowing remote attackers to trigger heap overflows and possibly execute arbitrary code. (CVE-2008-1482)
• Added a few more memory allocation checks to the above demuxers.
• WAV file playback fix: don’t assume that the first chunk is “fmt “.
• Don’t try to play partial 24-bit AIFF frames (decoder would lose data).
• Fixed AIFF comment chunk handling and sample rate reading.
• LPCM fixes: input over-reading, conversion of 24-bit samples.

Version 1.1.11:

• security fixes:
  • Array Indexing Vulnerability in sdpplin_parse(). (CVE-2008-0073)
• Reworked the plugin directory naming so that external plugins don’t have to be rebuilt for every release. We now use a naming scheme based on the API/ABI versioning, checking older directories – with this release, the plugin directory name is 1.20, and if this gets bumped to 1.21 in a future release, 1.20 will still be available for external plugins. (Any directories not 1.* won’t be looked in.)
• Made the version parsing much more reliable; it wasn’t properly coping with four-part version numbers. This affects any program whose build scripts use xine-lib’s automake macros.
• Fixed an off-by-one in the FLAC security fix patch. This breakage was causing failure to play some files.
• Support 16-bit big endian DTS audio.
• Improved frame snapshot API. (ABI extension.)
• Re-add support for # (stream parameter separator) in raw filenames, without the bugs found in the original implementation. (This is a convenience feature for users only. Front ends which rely on it for functions like subtitle file detection must instead use file:// MRLs; if they don’t, we consider them to be buggy.)
• Fixed long delay when closing stream on dual core systems [Bug #33]
• DVD playback improvement: don’t trust the file sizes.
• Build fixes for use with recent ffmpeg.