CVE-2006-1502

Multiple integer overflows in MPlayer 1.0pre7try2 allow remote attackers to
cause a denial of service and trigger heap-based buffer overflows via (1) a
certain ASF file handled by asfheader.c that causes the asf_descrambling
function to be passed a negative integer after the conversion from a char
to an int or (2) an AVI file with a crafted wLongsPerEntry or nEntriesInUse
value in the indx chunk, which is handled in aviheader.c.

Bugs

• <https://bugs.launchpad.net/ubuntu/+source/mplayer/+bug/163293&gt;