CVE-2008-0485

CRITICAL 9.3CVE-2008-0485 · Published 05/02/2008 · updated 16/06/2026

In short

CVE-2008-0485 is a CRITICAL (CVSS 9.3) vulnerability affecting mplayer (mplayer).
Chance of exploitation in the next 30 days (EPSS): 8.9%, higher than 95.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mplayer mplayer	`≤ 1.02rc2`	No fix yet

Description

Array index error in libmpdemux/demux_mov.c in MPlayer 1.0 rc2 and earlier might allow remote attackers to execute arbitrary code via a QuickTime MOV file with a crafted stsc atom tag.

References

lists.grok.org.uk/pipermail/full-disclosure/2008-February/060032.html
secunia.com/advisories/28779
secunia.com/advisories/28955
secunia.com/advisories/28956
secunia.com/advisories/29307
security.gentoo.org/glsa/glsa-200803-16.xml
securityreason.com/securityalert/3607
coresecurity.com
debian.org/security/2008/dsa-1496
mandriva.com/security/advisories
mplayerhq.hu/design7/news.html
securityfocus.com/archive/1/487500/100/0/threaded
securityfocus.com/bid/27499 · Exploit
securitytracker.com/id
vupen.com/english/advisories/2008/0406/references

More vulnerabilities in mplayer

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free