Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2 and other packages such as MPlayer that use the same code allows remote attackers to execute arbitrary code via long PNA_TAG values a different vulnerability than CVE-2004-1188.