A remote overflow exists in MPlayer. MPlayer fails to properly sanitize the "thewLongsPerEntry" and "nEntriesInUse" values in the "indx" chunk in an AVI file in "libmpdemux/aviheader.c" resulting in a heap-based buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity and/or availability.

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

• Security Tracker: 1015842
• Bugtraq ID: 17295
• Secunia Advisory ID: 19418 19565 19919 27016
• CVE ID: 2006-1502 (see also: NVD)
• SCIP VulDB ID: 2117
• Related OSVDB ID: 24246
• VUPEN Advisory: ADV-2006-1156
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1746.html
• Other Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200605-01.xml
  http://www.mandriva.com/security/advisories?name=MDKSA-2007:192
  http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:068
• Vendor URL: http://www.mplayerhq.hu/
• Keyword: xfocus-SD-060329

• XFOCUS Security Team - securityxfocus.org -