Description
Integer signedness error in DivX Web Player 1.4.2.7, and possibly earlier versions, allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format (STRF) chunk, which triggers a heap-based buffer overflow.
References
- 20090415 Secunia Research: DivX Web Player Stream Format Chunk Buffer Overflow mailing-list
- ADV-2009-1044 vdb-entry
- divxwebplayer-strf-bo(49908) vdb-entry
- 1022061 vdb-entry
- 33196 third-party-advisory
- http://secunia.com/secunia_research/2008-57/
- 34523 vdb-entry