Multiple buffer overflows in libavformat/utils.c in FFmpeg 0.4.9 before r14715, as used by MPlayer, allow context-dependent attackers to have an unknown impact via vectors related to execution of DTS generation code with a delay greater than MAX_REORDER_DELAY.

Several vulnerabilities have been discovered in mplayer, a movie player for Unix-like systems. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0385     It was discovered that watching a malformed 4X movie     file could lead to the execution of arbitrary code.

  - CVE-2008-4866     It was discovered that multiple buffer overflows could     lead to the execution of arbitrary code.

  - CVE-2008-5616     It was discovered that watching a malformed TwinVQ file     could lead to the execution of arbitrary code.

It was discovered that FFmpeg did not correctly handle certain malformed Ogg Media (OGM) files. If a user were tricked into opening a crafted Ogg Media file, an attacker could cause the application using FFmpeg to crash, leading to a denial of service. (CVE-2008-4610)

It was discovered that FFmpeg did not correctly handle certain parameters when creating DTS streams. If a user were tricked into processing certain commands, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.10. (CVE-2008-4866)

It was discovered that FFmpeg did not correctly handle certain malformed DTS Coherent Acoustics (DCA) files. If a user were tricked into opening a crafted DCA file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4867)

It was discovered that FFmpeg did not correctly handle certain malformed 4X movie (4xm) files. If a user were tricked into opening a crafted 4xm file, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0385).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in mplayer, which could allow remote attackers to execute arbitrary code via a malformed TwinVQ file (CVE-2008-5616), and in ffmpeg, as used by mplayer, related to the execution of DTS generation code (CVE-2008-4866) and incorrect handling of DCA_MAX_FRAME_SIZE value (CVE-2008-4867).

The updated packages have been patched to prevent this.

Several vulnerabilities have been discovered in ffmpeg, related to the execution of DTS generation code (CVE-2008-4866) and incorrect handling of DCA_MAX_FRAME_SIZE value (CVE-2008-4867).

The updated packages have been patched to prevent this.

The remote host is affected by the vulnerability described in GLSA-200903-33 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities were found in FFmpeg:
    astrange     reported a stack-based buffer overflow in the str_read_packet() in     libavformat/psxstr.c when processing .str files (CVE-2008-3162).
    Multiple buffer overflows in libavformat/utils.c     (CVE-2008-4866).
    A buffer overflow in libavcodec/dca.c     (CVE-2008-4867).
    An unspecified vulnerability in the     avcodec_close() function in libavcodec/utils.c (CVE-2008-4868).
    Unspecified memory leaks (CVE-2008-4869).
    Tobias Klein     repoerted a NULL pointer dereference due to an integer signedness error     in the fourxm_read_header() function in libavformat/4xm.c     (CVE-2009-0385).
  Impact :

    A remote attacker could entice a user to open a specially crafted media     file, possibly leading to the execution of arbitrary code with the     privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
38641	Debian DSA-1782-1 : mplayer - several vulnerabilities	Nessus	Debian Local Security Checks	critical
38037	Ubuntu 7.10 / 8.04 LTS / 8.10 : ffmpeg, ffmpeg-debian vulnerabilities (USN-734-1)	Nessus	Ubuntu Local Security Checks	critical
37645	Mandriva Linux Security Advisory : mplayer (MDVSA-2009:013)	Nessus	Mandriva Local Security Checks	critical
36388	Mandriva Linux Security Advisory : ffmpeg (MDVSA-2009:015)	Nessus	Mandriva Local Security Checks	critical
35969	GLSA-200903-33 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2008-4866

critical

Tenable Plugins

critical

critical

critical

critical

critical