Mandriva Linux Security Advisory : mplayer (MDVSA-2011:089)

Critical Nessus Plugin ID 54290


The remote Mandriva Linux host is missing one or more security updates.


Multiple vulnerabilities have been identified and fixed in mplayer :

FFmpeg 0.5 allows remote attackers to cause a denial of service (hang) via a crafted file that triggers an infinite loop. (CVE-2009-4636)

flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an arbitrary offset dereference vulnerability. (CVE-2010-3429)

libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file, related to the vorbis_floor0_decode function. (CVE-2010-4704)

Fix heap corruption crashes (CVE-2011-0722)

Fix invalid reads in VC-1 decoding (CVE-2011-0723)

And several additional vulnerabilities originally discovered by Google Chrome developers were also fixed with this advisory.

The updated packages have been patched to correct these issues.


Update the affected packages.

Plugin Details

Severity: Critical

ID: 54290

File Name: mandriva_MDVSA-2011-089.nasl

Version: $Revision: 1.9 $

Type: local

Published: 2011/05/17

Modified: 2016/03/07

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:mencoder, p-cpe:/a:mandriva:linux:mplayer, p-cpe:/a:mandriva:linux:mplayer-doc, p-cpe:/a:mandriva:linux:mplayer-gui, cpe:/o:mandriva:linux:2010.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2011/05/16

Reference Information

CVE: CVE-2009-4636, CVE-2010-3429, CVE-2010-4704, CVE-2011-0722, CVE-2011-0723

BID: 36465, 43546, 46294, 47149, 47151

OSVDB: 58508, 68269, 70650, 72574, 72578

MDVSA: 2011:089

CWE: 94