[ GLSA 200605-01 ] MPlayer: Heap-based buffer overflow

[GLSA]

Gentoo Linux Security Advisory

Title: MPlayer: Heap-based buffer overflow (GLSA 200605-01)
Severity: normal
Exploitable: remote
Date: May 01, 2006
Updated: June 21, 2006
Bug(s): #127969
ID: 200605-01

Synopsis

MPlayer contains multiple integer overflows that may lead to a heap-based buffer overflow.

Background

MPlayer is a media player that supports many multimedia file types.

Affected Packages

Package: media-video/mplayer
Vulnerable: < 1.0.20060415
Unaffected: >= 1.0.20060415
Unaffected: >= 1.0_pre8
Architectures: All supported architectures

Package: media-video/mplayer-bin
Vulnerable: < 1.0.20060415
Unaffected: >= 1.0.20060415
Unaffected: >= 1.0_pre8
Architectures: All supported architectures


Description

Xfocus Team discovered multiple integer overflows that may lead to a heap-based buffer overflow.

Impact

An attacker could entice a user to play a specially crafted multimedia file, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All MPlayer users should upgrade to the latest version: