PT-2007-6052 · Mplayer · Mplayer

Publicado 2007-09-18 · Atualizado 2018-10-15 · CVE-2007-4938

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MPlayer versions 1.0rc1 and earlier

Description The issue is related to a heap-based buffer overflow that can be triggered by a specially crafted .avi file. This file would contain certain large "indx truck size" and nEntriesInuse values, along with a specific wLongsPerEntry value. The overflow could allow remote attackers to cause a denial of service, resulting in an application crash, or possibly execute arbitrary code.

Recommendations For MPlayer versions 1.0rc1 and earlier, consider avoiding the use of .avi files from untrusted sources until a patch is available. As a temporary workaround, restrict the playback of .avi files to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-4938

DTSA-65-1

Produtos afetados

Mplayer

Referências · 13

• 🔥 https://exploit-db.com/exploits/30578 · Exploit
• 🔥 http://securityfocus.com/bid/25648 · Exploit
• 🔥 http://vulnhunt.com/advisories/CAL-20070912-1_Multiple_vendor_produce_handling_AVI_file_vulnerabilities.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4938 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2007-4938 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4938 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDKSA-2007:192 · Aviso do Fabricante
• http://securityfocus.com/archive/1/479222/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36581 · Nota
• http://securityreason.com/securityalert/3144 · Nota
• https://osv.dev/vulnerability/CVE-2007-4938 · Aviso do Fabricante
• http://osvdb.org/45940 · Nota
• http://secunia.com/advisories/27016 · Aviso do Fabricante