LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: September 26th, 2014
Linux Security Week: September 22nd, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: Updated mplayer packages fix integer overflow vulnerabilities Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake Multiple integer overflows in (1) the new_demux_packet function in demuxer.h and (2) the demux_asf_read_packet function in demux_asf.c in MPlayer 1.0pre7try2 and earlier allow remote attackers to execute arbitrary code via an ASF file with a large packet length value. The updated packages have been patched to prevent this problem.
 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2005:048
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : mplayer
 Date    : February 24, 2005
 Affected: 2006.0, Corporate 3.0
 _______________________________________________________________________
 
 Problem Description:
 
 Multiple integer overflows in (1) the new_demux_packet function in
 demuxer.h and (2) the demux_asf_read_packet function in demux_asf.c in
 MPlayer 1.0pre7try2 and earlier allow remote attackers to execute
 arbitrary code via an ASF file with a large packet length value.
 
 The updated packages have been patched to prevent this problem.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0579
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 6a9787d26d2b82697525ea3ce1a42528  2006.0/RPMS/libdha1.0-1.0-1.pre7.12.2.20060mdk.i586.rpm
 2cee96ab48d748bd5c218c6b72762a69  2006.0/RPMS/libpostproc0-1.0-1.pre7.12.2.20060mdk.i586.rpm
 7d85bd28f30c98b00002c4da1fb27935  2006.0/RPMS/libpostproc0-devel-1.0-1.pre7.12.2.20060mdk.i586.rpm
 eeaae4efea7c733946468504c0847c6e  2006.0/RPMS/mencoder-1.0-1.pre7.12.2.20060mdk.i586.rpm
 a3e1114604c50095b4a00e3e2546fad4  2006.0/RPMS/mplayer-1.0-1.pre7.12.2.20060mdk.i586.rpm
 7c1d40d98a7c63b84836f17742424572  2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.2.20060mdk.i586.rpm
 0ae9253d37d09e4e015c0dbea3e3238b  2006.0/SRPMS/mplayer-1.0-1.pre7.12.2.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 083cd368b22c862c3ad4e3c6809373ba  x86_64/2006.0/RPMS/lib64postproc0-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 f6764f327bc34aea319211a1ba848d46  x86_64/2006.0/RPMS/lib64postproc0-devel-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 7cd2b81fe303956e07ead2be2ce40d01  x86_64/2006.0/RPMS/mencoder-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 9962424187f6d7f99f91d65b22e62eea  x86_64/2006.0/RPMS/mplayer-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 fc4d22d72852405516379f36249626ae  x86_64/2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 0ae9253d37d09e4e015c0dbea3e3238b  x86_64/2006.0/SRPMS/mplayer-1.0-1.pre7.12.2.20060mdk.src.rpm

 Corporate 3.0:
 79227923f532fd0d481b6a8999a48fb6  corporate/3.0/RPMS/libdha0.1-1.0-0.pre3.14.6.C30mdk.i586.rpm
 8239e565804440e9b5f33dab590825c4  corporate/3.0/RPMS/libpostproc0-1.0-0.pre3.14.6.C30mdk.i586.rpm
 b92ecaf616a975c840fd2d8d1640141b  corporate/3.0/RPMS/libpostproc0-devel-1.0-0.pre3.14.6.C30mdk.i586.rpm
 1a5c6dba5378d086e76ec1c05f5fe416  corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.6.C30mdk.i586.rpm
 5d264152c0c2934f45c14576e3094a9d  corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.6.C30mdk.i586.rpm
 74c1e627dd747a52181e49502fa404b6  corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.6.C30mdk.i586.rpm
 7ea541987b4b2285112e6c822704b797  corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.6.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 49ab3887057e1a407e85b09cea56d977  x86_64/corporate/3.0/RPMS/lib64postproc0-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 3e8fdbfc03ba3bdbba4a31c52b8a6770  x86_64/corporate/3.0/RPMS/lib64postproc0-devel-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 8d45d891ed90b1576acbc512f035f9bf  x86_64/corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 2236312827cad9d6490340a9e7c66f6d  x86_64/corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 803888f3129e969e1351ce6ce8a88d59  x86_64/corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 7ea541987b4b2285112e6c822704b797  x86_64/corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.6.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Shellshock makes Heartbleed look insignificant
Hacker Group Lizard Squad Takes Down Destiny, Call of Duty, FIFA And More
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.