Articles / Debian: New mplayer package…

Debian: New mplayer packages fix arbitrary code execution

Several vulnerabilities have been discovered in mplayer, a movie player for Unix-like systems. It was discovered that watching a malformed 4X movie file could lead to the execution of arbitrary code. It was discovered that multiple buffer overflows could lead to the execution of arbitrary code. It was discovered that watching a malformed TwinVQ file could lead to the execution of arbitrary code. Updated packages are available from security.debian.org.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1782-1                  security@debian.org
http://www.debian.org/security/                      Steffen Joeris
April 29, 2009                        http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : mplayer
Vulnerability  : several vulnerabilities
Problem type   : local (remote)
Debian-specific: no
CVE Ids        : CVE-2009-0385 CVE-2008-4866 CVE-2008-5616
Debian Bug     : 508803


Several vulnerabilities have been discovered in mplayer, a movie player
for Unix-like systems. The Common Vulnerabilities and Exposures project
identifies the following problems:


CVE-2009-0385

It was discovered that watching a malformed 4X movie file could lead to
the execution of arbitrary code.

CVE-2008-4866

It was discovered that multiple buffer overflows could lead to the
execution of arbitrary code.

CVE-2008-5616

It was discovered that watching a malformed TwinVQ file could lead to
the execution of arbitrary code.


For the oldstable distribution (etch), these problems have been fixed
in version 1.0~rc1-12etch7.

For the stable distribution (lenny), mplayer links against
ffmpeg-debian.

For the testing distribution (squeeze) and the unstable distribution
(sid), mplayer links against ffmpeg-debian.


We recommend that you upgrade your mplayer packages.


Upgrade instructions
- --------------------

wget url
       will fetch the file for you
dpkg -i file.deb
       will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
       will update the internal database
apt-get upgrade
       will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1.orig.tar.gz
   Size/MD5 checksum: 10286260 815482129b79cb9390904b145c5def6c
 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7.dsc
   Size/MD5 checksum:     1273 e7c9ad9e2551b52efa5a3cdb8fd35d2c
 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7.diff.gz
   Size/MD5 checksum:    84770 d76ad6ec6787686da78803aa1adf9059

Architecture independent packages:

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0~rc1-12etch7_all.deb
   Size/MD5 checksum:  2044098 fd2f11f26dc0ec4ded4328e0b4d3e47e

alpha architecture (DEC Alpha)

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_alpha.deb
   Size/MD5 checksum:  4708256 97d33072d97c242841e1c9667832e848

amd64 architecture (AMD x86_64 (AMD64))

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_amd64.deb
   Size/MD5 checksum:  4383304 372b7f9d647f686a158147e40c48a26f

arm architecture (ARM)

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_arm.deb
   Size/MD5 checksum:  4327022 0b7f858f1f13d191f91b58637722a4f2

hppa architecture (HP PA RISC)

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_hppa.deb
   Size/MD5 checksum:  4384738 38aea3a449804561c3534f252223f099

i386 architecture (Intel ia32)

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_i386.deb
   Size/MD5 checksum:  4423484 c28e0b6a9225b90959e694c81de4dd65

ia64 architecture (Intel ia64)

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_ia64.deb
   Size/MD5 checksum:  5848864 90a731ea1de356a7c5271f6a482ec5bd

mips architecture (MIPS (Big Endian))

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_mips.deb
   Size/MD5 checksum:  4275736 268a3dda134988405a5f7cf130623229

powerpc architecture (PowerPC)

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_powerpc.deb
   Size/MD5 checksum:  4342866 3a7287844bd9e5770d0cbc46dfe40d71

s390 architecture (IBM S/390)

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_s390.deb
   Size/MD5 checksum:  4167778 34aaa0f7f4e971061b043599fe4c948a

sparc architecture (Sun SPARC/UltraSPARC)

 http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch7_sparc.deb
   Size/MD5 checksum:  4039612 63321e82e879daf54fa0ea022f6f657e


 These files will probably be moved into the stable distribution on
 its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkn3+ooACgkQ62zWxYk/rQe1TwCghKnnoUSU0E2JZjOWh2bY174Q
n7oAniHVnja5yyU859T8Z4HKIWHUPlf6
=jCI5
-----END PGP SIGNATURE-----
Screenshot

Project Spotlight

Kigo Video Converter Ultimate for Mac

A tool for converting and editing videos.

Screenshot

Project Spotlight

Kid3

An efficient tagger for MP3, Ogg/Vorbis, and FLAC files.