CVE-2008-5616 Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
HighCVSS 10.0
EPSS 7.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mplayer | <= 1.0_rc1 | No fix listed |
| mplayer | = 0.90 | No fix listed |
| mplayer | = 0.90_pre | No fix listed |
| mplayer | = 0.90_rc | No fix listed |
| mplayer | = 0.90_rc4 | No fix listed |
| mplayer | = 0.91 | No fix listed |
| mplayer | = 0.92 | No fix listed |
| mplayer | = 0.92.1 | No fix listed |
| mplayer | = 0.92_cvs | No fix listed |
| mplayer | = 1.0_pre1 | No fix listed |
| mplayer | = 1.0_pre2 | No fix listed |
| mplayer | = 1.0_pre3 | No fix listed |
| mplayer | = 1.0_pre3try2 | No fix listed |
| mplayer | = 1.0_pre4 | No fix listed |
| mplayer | = 1.0_pre5 | No fix listed |
| mplayer | = 1.0_pre5try1 | No fix listed |
| mplayer | = 1.0_pre5try2 | No fix listed |
| mplayer | = 1.0_pre6 | No fix listed |
| mplayer | = 1.0_pre7 | No fix listed |
| mplayer | = 1.0_pre7try2 | No fix listed |
| debian/mplayer(Debian:12) | < 1.0~rc2-19 | 1.0~rc2-19 |
| debian/mplayer(Debian:13) | < 1.0~rc2-19 | 1.0~rc2-19 |
| debian/mplayer(Debian:14) | < 1.0~rc2-19 | 1.0~rc2-19 |
References
- 33136 third-party-advisory vendor-advisory
- 34845 third-party-advisory
- svn.mplayerhq.hu
- svn.mplayerhq.hu
- trapkit.de
- DSA-1782 vendor-advisory
- MDVSA-2009:013 vendor-advisory
- MDVSA-2009:014 vendor-advisory
- 20081214 [TKADV2008-014] MPlayer TwinVQ Processing Stack Buffer Overflow Vulnerability mailing-list
- 32822 vdb-entry
- Debian Security Tracker CVE-2008-5616 vendor-advisory
- bugs.debian.org issue-tracking