PT-2007-2781 · Mplayer Team · Mplayer

Kees Cook · Published 2007-03-13 · Updated 2018-10-03 · CVE-2007-1387

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:H/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MPlayer versions 1.0rc1 and earlier

Description The issue is related to the DirectShow loader in MPlayer, which does not properly set the biSize before using it in a memcpy function. This can lead to a buffer overflow, potentially allowing remote attackers to execute arbitrary code. The issue is user-assisted, meaning it requires some action from the user to be exploited.

Recommendations For MPlayer versions 1.0rc1 and earlier, consider updating to a newer version that addresses this issue, as the current version may allow for arbitrary code execution due to the buffer overflow vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1387

DSA-1536-1

Affected Products

Mplayer

References · 17

• http://mandriva.com/security/advisories?name=MDKSA-2007:062 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-1387 · Vendor Advisory
• http://secunia.com/advisories/24462 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:061 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-1387 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200705-21.xml · Vendor Advisory
• https://usn.ubuntu.com/435-1 · Vendor Advisory
• http://debian.org/security/2008/dsa-1536 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1387 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1387 · Vendor Advisory
• http://secunia.com/advisories/24444 · Note
• http://secunia.com/advisories/25462 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414072%3Bmsg=12%3Bfilename=DS_VideoDecoder.c---SVN--22205.patch%3Batt=1 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414072 · Note
• http://secunia.com/advisories/24443 · Note