PT-2022-21224 · Mplayer · Mplayer

John Helmert Iii · CVE-2022-32317 · Published 2022-07-14 · Updated 2024-08-03

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions The MPlayer Project version 1.5

Description A heap use-after-free issue in the preinit function at libvo/vo v4l2.c can result in a double free, leading to a Denial of Service (DoS) via a crafted file. The device variable, which is assigned using strdup, is not executed on every call. This issue has been disputed by third parties as invalid and not reproducible.

Recommendations For version 1.5, consider restricting the use of crafted files to minimize the risk of exploitation. As a temporary workaround, review the code to ensure proper execution of the device=strdup statement. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2022-32317

Affected Products

Mplayer

References · 12

• 🔥 https://github.com/b17fr13nds/MPlayer_cve_poc · Exploit
• 🔥 https://transfer.sh/m2WcuM/poc_dup.zip · Exploit
• https://osv.dev/vulnerability/CVE-2022-32317 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32317 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-32317 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-32317 · Security Note
• https://t.me/cvenotify/36412 · Telegram Post
• https://t.me/cvenotify/33098 · Telegram Post
• https://bugs.gentoo.org/show_bug.cgi?id=858107 · Note
• https://t.me/cvenotify/79087 · Telegram Post
• https://t.me/cvenotify/88737 · Telegram Post