bugtraq - [ MDKSA-2005:048 ] - Updated mplayer packages fix integer overflow vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E1FCn0b-0007Ed-0A@mercury.mandriva.com>
Date: Fri, 24 Feb 2006 17:10:00 -0700
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDKSA-2005:048 ] - Updated mplayer packages fix integer overflow vulnerabilities



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2005:048
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : mplayer
 Date    : February 24, 2005
 Affected: 2006.0, Corporate 3.0
 _______________________________________________________________________
 
 Problem Description:
 
 Multiple integer overflows in (1) the new_demux_packet function in
 demuxer.h and (2) the demux_asf_read_packet function in demux_asf.c in
 MPlayer 1.0pre7try2 and earlier allow remote attackers to execute
 arbitrary code via an ASF file with a large packet length value.
 
 The updated packages have been patched to prevent this problem.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0579
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 6a9787d26d2b82697525ea3ce1a42528  2006.0/RPMS/libdha1.0-1.0-1.pre7.12.2.20060mdk.i586.rpm
 2cee96ab48d748bd5c218c6b72762a69  2006.0/RPMS/libpostproc0-1.0-1.pre7.12.2.20060mdk.i586.rpm
 7d85bd28f30c98b00002c4da1fb27935  2006.0/RPMS/libpostproc0-devel-1.0-1.pre7.12.2.20060mdk.i586.rpm
 eeaae4efea7c733946468504c0847c6e  2006.0/RPMS/mencoder-1.0-1.pre7.12.2.20060mdk.i586.rpm
 a3e1114604c50095b4a00e3e2546fad4  2006.0/RPMS/mplayer-1.0-1.pre7.12.2.20060mdk.i586.rpm
 7c1d40d98a7c63b84836f17742424572  2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.2.20060mdk.i586.rpm
 0ae9253d37d09e4e015c0dbea3e3238b  2006.0/SRPMS/mplayer-1.0-1.pre7.12.2.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 083cd368b22c862c3ad4e3c6809373ba  x86_64/2006.0/RPMS/lib64postproc0-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 f6764f327bc34aea319211a1ba848d46  x86_64/2006.0/RPMS/lib64postproc0-devel-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 7cd2b81fe303956e07ead2be2ce40d01  x86_64/2006.0/RPMS/mencoder-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 9962424187f6d7f99f91d65b22e62eea  x86_64/2006.0/RPMS/mplayer-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 fc4d22d72852405516379f36249626ae  x86_64/2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
 0ae9253d37d09e4e015c0dbea3e3238b  x86_64/2006.0/SRPMS/mplayer-1.0-1.pre7.12.2.20060mdk.src.rpm

 Corporate 3.0:
 79227923f532fd0d481b6a8999a48fb6  corporate/3.0/RPMS/libdha0.1-1.0-0.pre3.14.6.C30mdk.i586.rpm
 8239e565804440e9b5f33dab590825c4  corporate/3.0/RPMS/libpostproc0-1.0-0.pre3.14.6.C30mdk.i586.rpm
 b92ecaf616a975c840fd2d8d1640141b  corporate/3.0/RPMS/libpostproc0-devel-1.0-0.pre3.14.6.C30mdk.i586.rpm
 1a5c6dba5378d086e76ec1c05f5fe416  corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.6.C30mdk.i586.rpm
 5d264152c0c2934f45c14576e3094a9d  corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.6.C30mdk.i586.rpm
 74c1e627dd747a52181e49502fa404b6  corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.6.C30mdk.i586.rpm
 7ea541987b4b2285112e6c822704b797  corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.6.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 49ab3887057e1a407e85b09cea56d977  x86_64/corporate/3.0/RPMS/lib64postproc0-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 3e8fdbfc03ba3bdbba4a31c52b8a6770  x86_64/corporate/3.0/RPMS/lib64postproc0-devel-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 8d45d891ed90b1576acbc512f035f9bf  x86_64/corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 2236312827cad9d6490340a9e7c66f6d  x86_64/corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 803888f3129e969e1351ce6ce8a88d59  x86_64/corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
 7ea541987b4b2285112e6c822704b797  x86_64/corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.6.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFD/3SJmqjQ0CJFipgRAppdAJwMKNiyvLVH+QXkX5IOMRvGzhA8iACfawcl
4MpPnK4igEjRxRY2ODPNZdg=
=LcLq
-----END PGP SIGNATURE-----