PT-2007-6052 · Mplayer · Mplayer

Published 2007-09-18 · Updated 2018-10-15 · CVE-2007-4938

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MPlayer versions 1.0rc1 and earlier

Description The issue is related to a heap-based buffer overflow that can be triggered by a specially crafted .avi file. This file would contain certain large "indx truck size" and nEntriesInuse values, along with a specific wLongsPerEntry value. The overflow could allow remote attackers to cause a denial of service, resulting in an application crash, or possibly execute arbitrary code.

Recommendations For MPlayer versions 1.0rc1 and earlier, consider avoiding the use of .avi files from untrusted sources until a patch is available. As a temporary workaround, restrict the playback of .avi files to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-4938

DTSA-65-1

Affected Products

Mplayer

References · 13

• 🔥 https://exploit-db.com/exploits/30578 · Exploit
• 🔥 http://securityfocus.com/bid/25648 · Exploit
• 🔥 http://vulnhunt.com/advisories/CAL-20070912-1_Multiple_vendor_produce_handling_AVI_file_vulnerabilities.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4938 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-4938 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4938 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:192 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-4938 · Vendor Advisory
• http://secunia.com/advisories/27016 · Vendor Advisory
• http://securityfocus.com/archive/1/479222/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36581 · Note
• http://securityreason.com/securityalert/3144 · Note
• http://osvdb.org/45940 · Note