10757572 2003-09-29 16:22 +0200 /48 rader/ Daniel Ahlberg <aliz@gentoo.org>
Sänt av: gentoo-announce-return-160-11451=lyskom.lysator.liu.se@gentoo.org
Importerad: 2003-09-29 16:25 av Brevbäraren
Extern mottagare: gentoo-announce@gentoo.org
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: full-disclosure@lists.netsys.com
Mottagare: Gentoo (-) mailimport <236>
Mottagare: Bugtraq (import) <29315>
Sänt: 2003-09-29 18:37
Ärende: [gentoo-announce] GLSA: media-video/mplayer (200309-15)
------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200309-15
- ------------------------------------------------------------------------
PACKAGE : media-video/mplayer
SUMMARY : Buffer Overflow Vulnerability
DATE : 2003-09-27 21:37 UTC
EXPLOIT : remote
VERSIONS AFFECTED : <=mplayer-0.91 =mplayer-1.0_pre1
FIXED VERSION : =mplayer-0.92 =mplayer-1.0_pre1-r1
GENTOO BUG ID : 29640
CVE : none that we are aware of at this time
- ------------------------------------------------------------------------
SUMMARY:
A remotely exploitable buffer overflow vulnerability was found in
MPlayer. A malicious host can craft a harmful ASX header, and trick
MPlayer into executing arbitrary code upon parsing that header.
read the full advisory at:
http://www.mplayerhq.hu/homepage/design6/news.html
SOLUTION:
It is recommended that all Gentoo Linux users who are running
media-video/mplayer upgrade to mplayer-0.92 as follows
emerge sync
emerge =media-video/mplayer-0.92
emerge clean
Additionally PaX users might want to /sbin/chpax -m /usr/bin/mplayer
- - - ---------------------------------------------------------------------
solar@gentoo.org
aliz@gentoo.org - GnuPG key is available at http://dev.gentoo.org/~aliz
- - - ---------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQE/eEA1fT7nyhUpoZMRAtEeAJ9xPIFRQlixCojNLTxXbZnKc3HxogCgtfwE
FxePCaOajma2VGAWpq4YHag=
=75dn
-----END PGP SIGNATURE-----
(10757572) /Daniel Ahlberg <aliz@gentoo.org>/-------