PT-2008-2115 · Mplayer Team+1 · Libmpdemux+2

Tomas Hoger · Publicado 2008-02-05 · Atualizado 2018-10-15 · CVE-2008-0486

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MPlayer versions prior to 1.0rc2 and SVN versions prior to r25917 Xine-lib version 1.1.10

Description The issue is related to an array index vulnerability in the demux audio.c file of the libmpdemux module. This vulnerability might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow.

Recommendations For MPlayer versions prior to 1.0rc2 and SVN versions prior to r25917, update to a version that includes the fix for this issue. For Xine-lib version 1.1.10, consider disabling the use of FLAC tags until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2008-0486

DSA-1496-1

DSA-1536-1

DTSA-114-1

Produtos afetados

Mplayer

Xine-Lib

Libmpdemux

Referências · 37

• 🔥 http://coresecurity.com/?action=item&id=2103 · Exploit
• http://mplayerhq.hu/design7/news.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-0486 · Aviso do Fabricante
• http://secunia.com/advisories/28956 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200803-16.xml · Aviso do Fabricante
• http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=574735 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00442.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0486 · Aviso do Fabricante
• http://securityreason.com/securityalert/3608 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2008:045 · Aviso do Fabricante
• http://bugs.xine-project.org/show_bug.cgi?id=38 · Nota
• http://secunia.com/advisories/28989 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-0486 · Nota de Segurança
• http://secunia.com/advisories/31393 · Nota