Home page logo

bugtraq logo Bugtraq mailing list archives

MPlayer Security Advisory #01: Remotely exploitable buffer overflow
From: Gabucino <gabucino-NO-SPAM () mplayerhq hu>
Date: Thu, 25 Sep 2003 12:38:26 +0200

HIGH (if playing ASX streaming content)
LOW (if playing only normal files)

A remotely exploitable buffer overflow vulnerability was found in MPlayer.
A malicious host can craft a harmful ASX header, and trick MPlayer into
executing arbitrary code upon parsing that header.

MPlayer versions affected:
MPlayer 0.90pre series
MPlayer 0.90rc series
MPlayer 0.90
MPlayer 0.91
MPlayer 1.0pre1

MPlayer versions unaffected:
MPlayer releases before 0.90pre1
MPlayer 0.92

Notification status:
Developers were notified on 2003.09.24
Fix was commited into HEAD CVS at 2003.09.25 02:36:36 CEST
MPlayer 0.92 (vuln-fix-only release) was released on 2003.09.25 12:00:00 CEST

Patch availability:
A patch is available for all vulnerable versions.

Suggested upgrading methods:
MPlayer 1.0pre1 users should upgrade to latest CVS
MPlayer 0.91 (and below) users should upgrade to 0.92 OR latest CVS

MPlayer 0.92 is available for download.

MPlayer Core Team

Attachment: _bin

  By Date           By Thread  

Current thread:
  • MPlayer Security Advisory #01: Remotely exploitable buffer overflow Gabucino (Sep 26)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]