PT-2008-2115 · Mplayer Team+1 · Libmpdemux+2

Tomas Hoger · Published 2008-02-05 · Updated 2018-10-15 · CVE-2008-0486

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MPlayer versions prior to 1.0rc2 and SVN versions prior to r25917 Xine-lib version 1.1.10

Description The issue is related to an array index vulnerability in the demux audio.c file of the libmpdemux module. This vulnerability might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow.

Recommendations For MPlayer versions prior to 1.0rc2 and SVN versions prior to r25917, update to a version that includes the fix for this issue. For Xine-lib version 1.1.10, consider disabling the use of FLAC tags until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-0486

DSA-1496-1

DSA-1536-1

DTSA-114-1

Affected Products

Mplayer

Xine-Lib

Libmpdemux

References · 37

• 🔥 http://coresecurity.com/?action=item&id=2103 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2008-0486 · Vendor Advisory
• http://secunia.com/advisories/28956 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200803-16.xml · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00442.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0486 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:045 · Vendor Advisory
• http://secunia.com/advisories/28989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0486 · Security Note
• http://secunia.com/advisories/29307 · Vendor Advisory
• http://secunia.com/advisories/29601 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-0486 · Vendor Advisory
• http://secunia.com/advisories/29141 · Vendor Advisory
• http://secunia.com/advisories/28955 · Vendor Advisory