1. CVE-Search
  2. CVE-2008-3827
ID CVE-2008-3827
Summary Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of service (process termination) and possibly execute arbitrary code via a crafted video file that causes the stream_read function to read or write arbitrary memory.
References
Vulnerable Configurations
  • cpe:2.3:a:mplayer:mplayer:0.90:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:0.90:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:0.90_pre:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:0.90_pre:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:0.90_rc:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:0.90_rc:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:0.90_rc4:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:0.90_rc4:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:0.91:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:0.91:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:0.92:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:0.92:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:0.92.1:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:0.92.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:0.92_cvs:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:0.92_cvs:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre1:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre1:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre2:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre2:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre3:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre3:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre3try2:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre3try2:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre4:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre4:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre5:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre5:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre5try1:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre5try1:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre5try2:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre5try2:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre6:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre6:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre7:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre7:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_pre7try2:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_pre7try2:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:1.0_rc1:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:1.0_rc1:*:*:*:*:*:*:*
  • cpe:2.3:a:mplayer:mplayer:*:*:*:*:*:*:*:*
    cpe:2.3:a:mplayer:mplayer:*:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 11-10-2018 - 20:49)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
refmap via4
bid 31473
bugtraq 20080929 [oCERT-2008-013] MPlayer Real demuxer heap overflow
confirm http://svn.mplayerhq.hu/mplayer/trunk/libmpdemux/demux_real.c?r1=27314&r2=27675
debian DSA-1644
mandriva MDVSA-2008:219
misc http://www.ocert.org/advisories/ocert-2008-013.html
sectrack 1020952
secunia
  • 32045
  • 32153
sreason 4326
vupen ADV-2008-2703
Last major update 11-10-2018 - 20:49
Published 29-09-2008 - 19:25
Last modified 11-10-2018 - 20:49
Back to Top