CVE-2004-1187: Mandrakesoft Mandrake Linux

High severity, CVSS 10.0. EPSS: 5.2% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG values, a different vulnerability than CVE-2004-1188.

Affected products

• Mandrakesoft Mandrake Linux: version 10.0 only; version 10.1 only
• Mplayer Mplayer: version 0.90 only; version 0.90_pre only; version 0.90_rc only; version 0.90_rc4 only; version 0.91 only; version 0.92 only; …
• Xine Xine: version 0.9.8 only; version 0.9.13 only; version 0.9.18 only; version 1_alpha only; version 1_beta1 only; version 1_beta2 only; …
• Xine Xine-Lib: version 0.9.8 only; version 0.9.13 only; version 0.99 only; version 1_alpha only; version 1_beta1 only; version 1_beta2 only; …

Published 2005-01-10. Last modified 2026-06-16.