xine-lib 1.1.12 and other versions before 1.1.15 does not check for failure of malloc in circumstances including (1) the mymng_process_header function in demux_mng.c (2) the open_mod_file function in demux_mod.c and (3) frame_buffer allocation in the real_parse_audio_specific_data function in demux_real.c which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.