CVE-2008-0485 Array index error in libmpdemux/demux_mov.c in MPlayer 1.0 rc2 and earlier might allow remote attackers to execute arbitrary code via a QuickTime MOV file with a crafted stsc atom tag.
HighCVSS 9.3
EPSS 8.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Array index error in libmpdemux/demux_mov.c in MPlayer 1.0 rc2 and earlier might allow remote attackers to execute arbitrary code via a QuickTime MOV file with a crafted stsc atom tag.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mplayer | <= 1.02rc2 | No fix listed |
| debian/mplayer(Debian:12) | < 1.0~rc2-8 | 1.0~rc2-8 |
| debian/mplayer(Debian:13) | < 1.0~rc2-8 | 1.0~rc2-8 |
| debian/mplayer(Debian:14) | < 1.0~rc2-8 | 1.0~rc2-8 |
References
- Debian Security Tracker CVE-2008-0485 vendor-advisory
- bugs.debian.org issue-tracking
- 20080204 CORE-2008-0122: MPlayer arbitrary pointer dereference mailing-list
- 28779 third-party-advisory
- 28955 third-party-advisory
- 28956 third-party-advisory
- 29307 third-party-advisory
- GLSA-200803-16 vendor-advisory
- 3607 third-party-advisory
- www.coresecurity.com
- DSA-1496 vendor-advisory
- MDVSA-2008:045 vendor-advisory
- www.mplayerhq.hu
- 20080204 CORE-2008-0122: MPlayer arbitrary pointer dereference mailing-list
- 27499 exploit vdb-entry
- 1019299 vdb-entry
- ADV-2008-0406 vdb-entry