[CVE-2008-1878] Inadequate bounds checking in the NES Sound Format (NSF) demuxer

Please update xine-lib to 1.1.13 - this will solve several important bugs, like:
* [CVE-2008-1878] Inadequate bounds checking in the NES Sound Format (NSF) demuxer
* Ubuntu bug #93076 - important display bug with Motion JPEG video's (such videos are produced by most photo cameras)

I'm pasting important info from xine-lib to 1.1.13 Release Notes:

Maintenance & security-fix release.
Changes:
* Security fixes:
  - Buffer overflow in the NSF demuxer which may allow remote attackers to
    cause a denial of service (crash) or possibly execute arbitrary code
    via an NSF file with a long title or copyright message. (CVE-2008-1878)
  - For extra safety against possible Integer overflows like the ones found
    in CVE-2008-1482, backport more calloc usage from 1.2 branch.
* Added MIME types and .mpp for musepack.
* Fixed display of some MJPEG streams (YUVJ420P).
* Provide a useful implementation of xine_register_log_cb().
* New version of the JACK output plugin.

See http://sourceforge.net/project/shownotes.php?release_id=606977&group_id=9655 for full release notes

New upstream (1.1.14) fixing this issue is prepared.

This bug was fixed in the package xine-lib - 1.1.14-1ubuntu1

---------------
xine-lib (1.1.14-1ubuntu1) intrepid; urgency=low

  * merge from debian unstable. Remaining changes:
    - disable the jack plugin
      in libxine1-bin to make dapper->hardy upgrades work (LP #203605)
    - Modify Maintainer value to match the DebianMaintainerField
      specification.
  * New upstream fixes:
    - playback of MJPEG files LP: #93076
    - CVE-2008-1878 LP: #235904
    - CVE-2008-1686 LP: #218652
  * remove Replaces: libxine-main1 (<< 1.1.2+repacked1-0ubuntu1). We don't
    support upgrades from dapper/feisty anymore.

xine-lib (1.1.14-1) unstable; urgency=low

  * The "beat the freeze" release.
  * New upstream release.
    - All patches in 1.1.12-2 are present upstream.
    - MIME types added. (Closes: #472869)
  * Build-depend on libmagick9-dev | libmagick-dev | libmagickwand-dev.
  * Build-depend on ghostscript | gs | gs-gpl.

 -- Reinhard Tartler <email address hidden> Tue, 08 Jul 2008 22:35:48 +0200