[ MDVSA-2009:013 ] mplayer
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:013
http://www.mandriva.com/security/
_______________________________________________________________________
Package : mplayer
Date : January 15, 2009
Affected: 2008.1, 2009.0
_______________________________________________________________________
Problem Description:
Several vulnerabilities have been discovered in mplayer, which could
allow remote attackers to execute arbitrary code via a malformed
TwinVQ file (CVE-2008-5616), and in ffmpeg, as used by mplayer,
related to the execution of DTS generation code (CVE-2008-4866)
and incorrect handling of DCA_MAX_FRAME_SIZE value (CVE-2008-4867).
The updated packages have been patched to prevent this.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4866
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4867
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5616
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.1:
615c485d4e49252790f6903475cf5012
2008.1/i586/mencoder-1.0-1.rc2.10.5mdv2008.1.i586.rpm
174ff57498f0aed4e27215243ffc1e7a
2008.1/i586/mplayer-1.0-1.rc2.10.5mdv2008.1.i586.rpm
bf525ed83d1d2cda81fec2ad3d54a4e5
2008.1/i586/mplayer-doc-1.0-1.rc2.10.5mdv2008.1.i586.rpm
f3c2e5cc7dfd7d73acf7139c56d72f2b
2008.1/i586/mplayer-gui-1.0-1.rc2.10.5mdv2008.1.i586.rpm
20236bfcda9e9cf72768f22276535a2d
2008.1/SRPMS/mplayer-1.0-1.rc2.10.5mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
bef89850f6b0ea9a943ac357b60b0a43
2008.1/x86_64/mencoder-1.0-1.rc2.10.5mdv2008.1.x86_64.rpm
cee0def5985100dfbb73d7f7947af336
2008.1/x86_64/mplayer-1.0-1.rc2.10.5mdv2008.1.x86_64.rpm
f54ac4346398f00042844e62c211ea2a
2008.1/x86_64/mplayer-doc-1.0-1.rc2.10.5mdv2008.1.x86_64.rpm
1745576512f4c556f8c412d0be97ab39
2008.1/x86_64/mplayer-gui-1.0-1.rc2.10.5mdv2008.1.x86_64.rpm
20236bfcda9e9cf72768f22276535a2d
2008.1/SRPMS/mplayer-1.0-1.rc2.10.5mdv2008.1.src.rpm
Mandriva Linux 2009.0:
091da5e331e75a0a4eff3d18555a3f44
2009.0/i586/mencoder-1.0-1.rc2.18.2mdv2009.0.i586.rpm
cf045eb24ce6160925b1494c436145b7
2009.0/i586/mplayer-1.0-1.rc2.18.2mdv2009.0.i586.rpm
25169ddef93d8357c52decc681eb5a45
2009.0/i586/mplayer-doc-1.0-1.rc2.18.2mdv2009.0.i586.rpm
047f63983541bf68da05c0172466962a
2009.0/i586/mplayer-gui-1.0-1.rc2.18.2mdv2009.0.i586.rpm
b56e1c35a47104953c42ea0a5fbe826c
2009.0/SRPMS/mplayer-1.0-1.rc2.18.2mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
4d468adcbb6713f7995e5d60f070e6ad
2009.0/x86_64/mencoder-1.0-1.rc2.18.2mdv2009.0.x86_64.rpm
305e6ba8973e27c21dec655b61c36134
2009.0/x86_64/mplayer-1.0-1.rc2.18.2mdv2009.0.x86_64.rpm
3daf3c6b26a84320424a9719ba23a0b9
2009.0/x86_64/mplayer-doc-1.0-1.rc2.18.2mdv2009.0.x86_64.rpm
fe27d24ba0192af6c874a156a0e66365
2009.0/x86_64/mplayer-gui-1.0-1.rc2.18.2mdv2009.0.x86_64.rpm
b56e1c35a47104953c42ea0a5fbe826c
2009.0/SRPMS/mplayer-1.0-1.rc2.18.2mdv2009.0.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJb9b/mqjQ0CJFipgRAtPfAKDT13mYgFkllD8255Vj/nEoI1XaDQCg12ch
1oRjJCzLQfsI1oKxaDJeXQ8=
=Rqxm
-----END PGP SIGNATURE-----