Debian: DSA-2044-1: New mplayer packages fix arbitrary code execution

    Date11 May 2010
    CategoryDebian
    39
    Posted ByLinuxSecurity Advisories
    tixxDZ (DZCORE labs) discovered a vulnerability in the mplayer movie player. Missing data validation in mplayer's real data transport (RDT) implementation enable an integer underflow and consequently an unbounded buffer operation. A maliciously crafted stream could thus enable an
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-2044-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                           Devin Carraway
    May 11, 2010                          http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : mplayer
    Vulnerability  : integer overflow
    Problem type   : local (remote)
    Debian-specific: no
    
    tixxDZ (DZCORE labs) discovered a vulnerability in the mplayer movie
    player.  Missing data validation in mplayer's real data transport (RDT)
    implementation enable an integer underflow and consequently an unbounded
    buffer operation.  A maliciously crafted stream could thus enable an
    attacker to execute arbitrary code.
    
    No Common Vulnerabilities and Exposures project identifier is available for
    this issue.
    
    For the stable distribution (lenny), this problem has been fixed in version
    1.0~rc2-17+lenny3.2.
    
    We recommend that you upgrade your mplayer packages.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    
    Debian (stable)
    - ---------------
    
    Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2.dsc
        Size/MD5 checksum:     2108 9ca97232aaa217afe30aef9800fdde5b
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2.diff.gz
        Size/MD5 checksum:   360178 0cc960471e6ec0348456c014c774d941
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2.orig.tar.gz
        Size/MD5 checksum: 11727998 f1da15bc4accee0a5551928e31d7b779
    
    Architecture independent packages:
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0~rc2-17+lenny3.2_all.deb
        Size/MD5 checksum:  2462986 7cc9feae37dfc8b1be944894a9891689
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_alpha.deb
        Size/MD5 checksum:  3236612 5481602134b6af1771014eb7421de776
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_alpha.deb
        Size/MD5 checksum:  2233470 f033d746bfcd34cd209881b0331ef76f
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_amd64.deb
        Size/MD5 checksum:  3034790 7a9f3b0f603f127a59d9b0f1809b824f
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_amd64.deb
        Size/MD5 checksum:  2281646 44731cb89ba3b80811d38cebc1172a5c
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_arm.deb
        Size/MD5 checksum:  2705438 76a8e88ec753cebda6fb72b6906b5a14
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_arm.deb
        Size/MD5 checksum:  1977840 e6911242b55c4b5e906f433509491f99
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_hppa.deb
        Size/MD5 checksum:  2052866 ca07a7fa2a1d81132457b3a2ae2f8223
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_hppa.deb
        Size/MD5 checksum:  2896686 a47fda1190c2460980aef76ea297f0bd
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_i386.deb
        Size/MD5 checksum:  2370060 38e7272ca5582496be4a2f60f627f4b0
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_i386.deb
        Size/MD5 checksum:  3032114 fa1a9d2c47430dadc81bd41ab6620cd2
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_ia64.deb
        Size/MD5 checksum:  2056822 333d96f89bdf9d180c411501d952299e
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_ia64.deb
        Size/MD5 checksum:  3580016 ea7ae7ac0e7837cec6b1bc4be405eef0
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_mips.deb
        Size/MD5 checksum:  2847092 9b8f943f84c5c60eea7d20ad0ebf0826
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_mips.deb
        Size/MD5 checksum:  2120824 00788d698af99aad978503ea23bdd8b3
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_mipsel.deb
        Size/MD5 checksum:  2064680 ff215968a214023be4dbb3875554c72b
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_mipsel.deb
        Size/MD5 checksum:  2840214 003e55d7e3c6b127a41b16ab99f09c43
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_powerpc.deb
        Size/MD5 checksum:  1991722 a94b911fecf6f37d14d5de2d1fe9a0ed
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_powerpc.deb
        Size/MD5 checksum:  2867096 b6e68c0ff32e3974b0c84726ce57e215
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_s390.deb
        Size/MD5 checksum:  2128050 b4075e1fb1350e32061cf5635b9b9556
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_s390.deb
        Size/MD5 checksum:  2779844 b14c2c35e7287400b7c92f83b957061d
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer-dbg_1.0~rc2-17+lenny3.2_sparc.deb
        Size/MD5 checksum:  1898760 cbb824eafc9af867275f4abffbc89cd7
      http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc2-17+lenny3.2_sparc.deb
        Size/MD5 checksum:  2688394 52c4508095e92e4e30b8a3d5da56b1fe
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"40","type":"x","order":"1","pct":48.78,"resources":[]},{"id":"88","title":"Should be more technical","votes":"13","type":"x","order":"2","pct":15.85,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"29","type":"x","order":"3","pct":35.37,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.