Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.

Several vulnerabilities have been discovered in mplayer, a movie player for Unix-like systems. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0385     It was discovered that watching a malformed 4X movie     file could lead to the execution of arbitrary code.

  - CVE-2008-4866     It was discovered that multiple buffer overflows could     lead to the execution of arbitrary code.

  - CVE-2008-5616     It was discovered that watching a malformed TwinVQ file     could lead to the execution of arbitrary code.

Several vulnerabilities have been discovered in mplayer, which could allow remote attackers to execute arbitrary code via a malformed TwinVQ file (CVE-2008-5616), and in ffmpeg, as used by mplayer, related to the execution of DTS generation code (CVE-2008-4866) and incorrect handling of DCA_MAX_FRAME_SIZE value (CVE-2008-4867).

The updated packages have been patched to prevent this.

Several vulnerabilities have been discovered in mplayer, which could allow remote attackers to execute arbitrary code via a malformed TwinVQ file (CVE-2008-5616), and in ffmpeg, as used by mplayer, related to the execution of DTS generation code (CVE-2008-4866).

The updated packages have been patched to prevent this.

The remote host is affected by the vulnerability described in GLSA-200901-07 (MPlayer: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in MPlayer:
    A     stack-based buffer overflow was found in the str_read_packet() function     in libavformat/psxstr.c when processing crafted STR files that     interleave audio and video sectors (CVE-2008-3162).
    Felipe     Andres Manzano reported multiple integer underflows in the     demux_real_fill_buffer() function in demux_real.c when processing     crafted Real Media files that cause the stream_read() function to read     or write arbitrary memory (CVE-2008-3827).
    Tobias Klein     reported a stack-based buffer overflow in the demux_open_vqf() function     in libmpdemux/demux_vqf.c when processing malformed TwinVQ files     (CVE-2008-5616).
  Impact :

    A remote attacker could entice a user to open a specially crafted STR,     Real Media, or TwinVQ file to execute arbitrary code or cause a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

A trapkit reports :

MPlayer contains a stack-based buffer overflow vulnerability while parsing malformed TwinVQ media files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of MPlayer.

ID	Name	Product	Family	Type	Severity
38641	Debian DSA-1782-1 : mplayer - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
37645	Mandriva Linux Security Advisory : mplayer (MDVSA-2009:013)	Nessus	Mandriva Local Security Checks	Local	critical
36762	Mandriva Linux Security Advisory : mplayer (MDVSA-2009:014)	Nessus	Mandriva Local Security Checks	Local	critical
35355	GLSA-200901-07 : MPlayer: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
35280	FreeBSD : mplayer -- twinvq processing buffer overflow vulnerability (7c5bd5b8-d652-11dd-a765-0030843d3802)	Nessus	FreeBSD Local Security Checks	Local	critical

Detections

Analytics

CVE-2008-5616

critical

Tenable Plugins

critical

critical

critical

critical

critical