[ MDVSA-2008:219 ] mplayer

[dude67]

A vulnerability that was discovered in xine-lib that allowed remote
RTSP servers to execute arbitrary code via a large streamid SDP
parameter also affects MPlayer (CVE-2008-0073).

Several integer overflows were discovered by Felipe Andres Manzano
in MPlayer's Real video stream demuxing code. These vulnerabilities
could allow an attacker to cause a crash or possibly execute arbitrary
code by supplying a malicious crafted video file (CVE-2008-3827).

The updated packages have been patched to fix these issues.
Note that CVE-2008-3827 was already corrected in the Mandriva Linux
2009 packages.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-0073
http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-3827
http://www.ocert.org/advisories/ocert-2008-013.html
_______________________________________________________________________