When opening a malicious MRL in any xine-lib or xine-ui based media player, an attacker can write arbitrary content to an arbitrary file, only restricted by the permissions of the user running the application.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33149/XSA-2004-1and2.html
Source: https://packetstormsecurity.com/files/33149/XSA-2004-1and2.html.html