{"cve":"CVE-2004-1188","nvd":{"published":"2005-01-10T05:00:00.000","modified":"2026-06-16T22:07:13.180","status":"Modified","description":"The pnm_get_chunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the PREAMBLE_SIZE, which causes a read operation with a negative length that leads to a buffer overflow via (1) RMF_TAG, (2) DATA_TAG, (3) PROP_TAG, (4) MDPR_TAG, and (5) CONT_TAG values, a different vulnerability than CVE-2004-1187.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/input/pnm.c?r1=1.20&r2=1.21","http://www.idefense.com/application/poi/display?id=177&type=vulnerabilities","http://www.mandriva.com/security/advisories?name=MDKSA-2005:011","http://www.mplayerhq.hu/MPlayer/patches/pnm_fix_20041215.diff","https://exchange.xforce.ibmcloud.com/vulnerabilities/18638"],"products":["mandrakesoft:mandrake_linux","mplayer:mplayer","xine:xine","xine:xine-lib"],"source":"nvd","synced_at":"2026-10-19T19:38:22.000386253+00:00"},"epss":{"cve":"CVE-2004-1188","score":0.01965,"percentile":0.80354,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}