MGASA-2024-0062 - Updated mplayer packages fix security vulnerabilities

Publication date: 15 Mar 2024
URL: https://advisories.mageia.org/MGASA-2024-0062.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2022-38850,
     CVE-2022-38851,
     CVE-2022-38855,
     CVE-2022-38858,
     CVE-2022-38860,
     CVE-2022-38861,
     CVE-2022-38863,
     CVE-2022-38864,
     CVE-2022-38865,
     CVE-2022-38866

The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide
By Zero via the function config () of llibmpcodecs/vf_scale.c.
(CVE-2022-38850)
Certain The MPlayer Project products are vulnerable to Out-of-bounds
Read via function read_meta_record() of mplayer/libmpdemux/asfheader.c.
This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
(CVE-2022-38851)
Certain The MPlayer Project products are vulnerable to Buffer Overflow
via function gen_sh_video () of mplayer/libmpdemux/demux_mov.c. This
affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
(CVE-2022-38855)
Certain The MPlayer Project products are vulnerable to Buffer Overflow
via function mov_build_index() of libmpdemux/demux_mov.c. This affects
mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
(CVE-2022-38858)
Certain The MPlayer Project products are vulnerable to Divide By Zero
via function demux_open_avi() of libmpdemux/demux_avi.c which affects
mencoder. This affects mplayer SVN-r38374-13.0.1 and mencoder
SVN-r38374-13.0.1. (CVE-2022-38860)
The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory
corruption via function free_mp_image() of libmpcodecs/mp_image.c.
(CVE-2022-38861)
Certain The MPlayer Project products are vulnerable to Buffer Overflow
via function mp_getbits() of libmpdemux/mpeg_hdr.c which affects
mencoder and mplayer. This affects mecoder SVN-r38374-13.0.1 and mplayer
SVN-r38374-13.0.1. (CVE-2022-38863)
Certain The MPlayer Project products are vulnerable to Buffer Overflow
via the function mp_unescape03() of libmpdemux/mpeg_hdr.c. This affects
mencoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1.
(CVE-2022-38864)
Certain The MPlayer Project products are vulnerable to Divide By Zero
via the function demux_avi_read_packet of libmpdemux/demux_avi.c. This
affects mplyer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
(CVE-2022-38865)
Certain The MPlayer Project products are vulnerable to Buffer Overflow
via read_avi_header() of libmpdemux/aviheader.c . This affects mplayer
SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1. (CVE-2022-38866)

References:
- https://bugs.mageia.org/show_bug.cgi?id=31360
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38850
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38851
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38855
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38858
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38860
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38861
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38863
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38864
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38865
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38866

SRPMS:
- 9/core/mplayer-1.5-12.1.mga9
- 9/tainted/mplayer-1.5-12.1.mga9.tainted

Mageia 2024-0062: mplayer security update

The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf_scale.c

Summary

The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf_scale.c. (CVE-2022-38850) Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function read_meta_record() of mplayer/libmpdemux/asfheader.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1. (CVE-2022-38851) Certain The MPlayer Project products are vulnerable to Buffer Overflow via function gen_sh_video () of mplayer/libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1. (CVE-2022-38855) Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov_build_index() of libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1. (CVE-2022-38858) Certain The MPlayer Project products are vulnerable to Divide By Zero via function demux_open_avi() of libmpdemux/demux_avi.c which affects mencoder. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1. (CVE-2022-38860) The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via function free_mp_image() of libmpcodecs/mp_image.c. (CVE-2022-38861) Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mp_getbits() of libmpdemux/mpeg_hdr.c which affects mencoder and mplayer. This affects mecoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1. (CVE-2022-38863) Certain The MPlayer Project products are vulnerable to Buffer Overflow via the function mp_unescape03() of libmpdemux/mpeg_hdr.c. This affects mencoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1. (CVE-2022-38864) Certain The MPlayer Project products are vulnerable to Divide By Zero via the function demux_avi_read_packet of libmpdemux/demux_avi.c. This affects mplyer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1. (CVE-2022-38865) Certain The MPlayer Project products are vulnerable to Buffer Overflow via read_avi_header() of libmpdemux/aviheader.c . This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1. (CVE-2022-38866)

References

- https://bugs.mageia.org/show_bug.cgi?id=31360

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38850

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38851

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38855

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38858

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38860

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38861

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38863

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38864

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38865

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38866

Resolution

MGASA-2024-0062 - Updated mplayer packages fix security vulnerabilities

SRPMS

- 9/core/mplayer-1.5-12.1.mga9

- 9/tainted/mplayer-1.5-12.1.mga9.tainted

Severity
Publication date: 15 Mar 2024
URL: https://advisories.mageia.org/MGASA-2024-0062.html
Type: security
CVE: CVE-2022-38850, CVE-2022-38851, CVE-2022-38855, CVE-2022-38858, CVE-2022-38860, CVE-2022-38861, CVE-2022-38863, CVE-2022-38864, CVE-2022-38865, CVE-2022-38866

Related News

CISA Sounds Alarm on Newly Exploited Vulnerabilities: Is Your System at Risk?
3 - 5 min read
CISA regularly publishes updates regarding vulnerabilities that present severe threats to global cybersecurity. Recently, CISA added three
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered
Open Source Strategies for Enhancing Security in Digital Business Operations
5 - 9 min read
Digital transformation, powered by the principles of open-source security , is vital for businesses looking to excel in today's technology-driven

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved