[SECURITY] [DLA 457-1] mplayer security update

2016-05-0420:51:45

lists.debian.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.3

Confidence

High

EPSS

0.002

Percentile

56.6%

JSON

Package : mplayer
Version : 2:1.0~rc4.dfsg1+svn34540-1+deb7u2
CVE ID : CVE-2016-4352

Mplayer is crashing when playing a fuzzed gif file. The gif demuxes
assumes in many places that width*height is <= INT_MAX; this might
not be true. Fixed by validating the picture size.

OSVersionArchitecturePackageVersionFilename
Debian7i386mplayer< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2mplayer_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_i386.deb
Debian7allmplayer2< 2.0-554-gf63dbad-1+deb7u1mplayer2_2.0-554-gf63dbad-1+deb7u1_all.deb
Debian7armhfmplayer2-dbg< 2.0-554-gf63dbad-1+deb7u1mplayer2-dbg_2.0-554-gf63dbad-1+deb7u1_armhf.deb
Debian7amd64mencoder< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2mencoder_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_amd64.deb
Debian7armhfmplayer-gui< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2mplayer-gui_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_armhf.deb
Debian7armhfmplayer< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2mplayer_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_armhf.deb
Debian7armhfmencoder< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2mencoder_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_armhf.deb
Debian7amd64mplayer< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2mplayer_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_amd64.deb
Debian7i386mplayer-dbg< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2mplayer-dbg_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_i386.deb
Debian7armelmplayer2-dbg< 2.0-554-gf63dbad-1+deb7u1mplayer2-dbg_2.0-554-gf63dbad-1+deb7u1_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	i386	mplayer	< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2	mplayer_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_i386.deb
Debian	7	all	mplayer2	< 2.0-554-gf63dbad-1+deb7u1	mplayer2_2.0-554-gf63dbad-1+deb7u1_all.deb
Debian	7	armhf	mplayer2-dbg	< 2.0-554-gf63dbad-1+deb7u1	mplayer2-dbg_2.0-554-gf63dbad-1+deb7u1_armhf.deb
Debian	7	amd64	mencoder	< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2	mencoder_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_amd64.deb
Debian	7	armhf	mplayer-gui	< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2	mplayer-gui_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_armhf.deb
Debian	7	armhf	mplayer	< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2	mplayer_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_armhf.deb
Debian	7	armhf	mencoder	< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2	mencoder_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_armhf.deb
Debian	7	amd64	mplayer	< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2	mplayer_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_amd64.deb
Debian	7	i386	mplayer-dbg	< 2:1.0~rc4.dfsg1+svn34540-1+deb7u2	mplayer-dbg_2:1.0~rc4.dfsg1+svn34540-1+deb7u2_i386.deb
Debian	7	armel	mplayer2-dbg	< 2.0-554-gf63dbad-1+deb7u1	mplayer2-dbg_2.0-554-gf63dbad-1+deb7u1_armel.deb