Description
Buffer overflow in url.c in MPlayer 1.0rc2 and SVN before r25823 allows remote attackers to execute arbitrary code via a crafted URL that prevents the IPv6 parsing code from setting a pointer to NULL, which causes the buffer to be reused by the unescape code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mplayer | 1.0~rc2-8 | — |
| Debian 13 | mplayer | 1.0~rc2-8 | — |
| Debian 12 | mplayer | 1.0~rc2-8 | — |
| Debian 5.0 | mplayer | 1.0~rc2-7+lenny1 | DTSA-114-1 |
| Debian 4.0 | mplayer | 1.0~rc1-12etch2 | DSA-1496-1 |
Advisories 2
- DSA-1496-1 mplayer - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-114-1 mplayer - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.mplayerhq.hu/design7/news.html
- MDVSA-2008:045 vendor-advisory
- 28955 third-party-advisory
- 27766 vdb-entry
- 29307 third-party-advisory
- DSA-1496 vendor-advisory
- GLSA-200803-16 vendor-advisory
- 28956 third-party-advisory