VDB
CVE-2007-1387
CVE-2007-1387
PUBLISHED
CVSS 6.800000190734863 MEDIUM
The DirectShow loader (loader/dshow/DS_VideoDecoder.c) in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1246.
EPSS 4.18% · 90.1th percentile
Risk Scores
CVSS 2.0
6.800000190734863
EPSS Score
4.18%
90.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| mplayer | mplayer | 0 |
| n/a | n/a | * |
Timeline
- Mar 13, 2007 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 26, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
- Sep 23, 2023 EPSS Score
- Oct 31, 2023 EPSS Score
References
- 24462 third-party-advisory
- 22933 vdb
- MDKSA-2007:061 vendor-advisory
- 29601 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414072%3Bmsg=12%3Bfilename=DS_VideoDecoder.c---SVN--22205.patch%3Batt=1 url
- 24443 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414072 url
- USN-435-1 vendor-advisory
- MDKSA-2007:062 vendor-advisory
- 25462 third-party-advisory
- DSA-1536 vendor-advisory
- 24444 third-party-advisory
- GLSA-200705-21 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2007-1387 advisory
- https://usn.ubuntu.com/435-1 url
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414072;msg=12;filename=DS_VideoDecoder.c---SVN--22205.patch;att=1 url