CVE-2007-1387

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The DirectShow loader (loader/dshow/DS_VideoDecoder.c) in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1246.

El cargador DirectShow (loader/dshow/DS_VideoDecoder.c) en MPlayer 1.0rc1 y anteriores, como el usado en xine-lib, no establece el biSize antes de usarse en memcpy, lo cual permite a atacantes remotos con la complicidad del usuario provocar un desbordamiento de búfer y posiblemente ejecutar código de su elección, una vulnerabilidad diferente que CVE-2007-1246.

*Credits: N/A

CVSS Scores

NISTv2 6.8

Attack Vector

Network

Attack Complexity

High

Authentication

Multiple

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-03-10 CVE Reserved
2007-03-13 CVE Published
2024-02-22 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (13)

URL	Tag	Source
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414072	X_refsource_confirm
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414072%3Bmsg=12%3Bfilename=DS_VideoDecoder.c---SVN--22205.patch%3Batt=1	X_refsource_misc
http://secunia.com/advisories/24443	Third Party Advisory
http://secunia.com/advisories/24444	Third Party Advisory
http://secunia.com/advisories/25462	Third Party Advisory
http://secunia.com/advisories/29601	Third Party Advisory
http://www.securityfocus.com/bid/22933	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/24462	2023-11-07
http://security.gentoo.org/glsa/glsa-200705-21.xml	2023-11-07
http://www.debian.org/security/2008/dsa-1536	2023-11-07
http://www.mandriva.com/security/advisories?name=MDKSA-2007:061	2023-11-07
http://www.mandriva.com/security/advisories?name=MDKSA-2007:062	2023-11-07
https://usn.ubuntu.com/435-1	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mplayer Search vendor "Mplayer"		Mplayer Search vendor "Mplayer" for product "Mplayer"				<= 1.0_rc1 Search vendor "Mplayer" for product "Mplayer" and version " <= 1.0_rc1"		-		Affected