Digital Edition

SYS-CON.TV
Security Alert: Mplayer Users Urged to Upgrade to Latest Version
Security Alert: Mplayer Users Urged to Upgrade to Latest Version

Users of the popular Mplayer media device are being urged to upgrade to the latest version, due to a bug. The vulnerability is in the GUI interface, which contains buffer overflow weak-spots. A skillfully crafted, bogus GUI interface could be used to get the user to play the system, and hence execute arbitrary code.

Vulnerable versions are those before 1.0 pre4. Gentoo Linux suggested updating to a later release. Developers were more cautious and urged users of Mplayers not to use the GUI at all since other similar bugs are likely to be discovered.

In June, one programmer wrote on a developers' e-mail list that there are many buffer overflows in Mplayer. "I would recommend not using the GUI," he wrote. "This code is so nasty and broken that I'm not going to spend my time fixing it... if you want the GUI to work, and don't want to be embarrassed by remote [vulnerabilities] in Mplayer, step up and fix it."

All Mplayers are vulnerable to this problem. A month ago the bug was reported on the Bugtrap security mailing list. A patch was release by the Mplayer project in response that Linux vendors are now using.

About Security News Desk
SYS-CON's Security News desk trawls the world of security for news of software, hardware, products, and services that seems likely to be of interest to infosec professionals and summarizes them for easy assimilation by busy IT managers and staff.

In order to post a comment you need to be registered and logged in.

Register | Sign-in

Reader Feedback: Page 1 of 1



ADS BY GOOGLE
Subscribe to the World's Most Powerful Newsletters

ADS BY GOOGLE

Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud,...
Containers and Kubernetes allow for code portability across on-premise VMs, bare metal, or multiple ...
DXWorldEXPO LLC announced today that "IoT Now" was named media sponsor of CloudEXPO | DXWorldEXPO 20...
Modern software design has fundamentally changed how we manage applications, causing many to turn to...
In this presentation, you will learn first hand what works and what doesn't while architecting and d...
In an era of historic innovation fueled by unprecedented access to data and technology, the low cost...
In his session at 20th Cloud Expo, Mike Johnston, an infrastructure engineer at Supergiant.io, discu...
Everyone wants the rainbow - reduced IT costs, scalability, continuity, flexibility, manageability, ...
DXWorldEXPO | CloudEXPO are the world's most influential, independent events where Cloud Computing w...
Founded in 2000, Chetu Inc. is a global provider of customized software development solutions and IT...
DevOpsSummit New York 2018, colocated with CloudEXPO | DXWorldEXPO New York 2018 will be held Novemb...
Most DevOps journeys involve several phases of maturity. Research shows that the inflection point wh...
Dynatrace is an application performance management software company with products for the informatio...
SYS-CON Events announced today that DatacenterDynamics has been named “Media Sponsor” of SYS-CON's 1...
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018,...
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, ...
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22...
Today, we have more data to manage than ever. We also have better algorithms that help us access our...
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: D...
A valuable conference experience generates new contacts, sales leads, potential strategic partners a...