Back to Database
Status published
Critical
CVE-2004-1187
Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2,...
Vulnerability Description
Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG values, a different vulnerability than CVE-2004-1188.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2004-1187
Credits & Attribution
No credits recorded in the NVD database.
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18640
- http://www.mplayerhq.hu/MPlayer/patches/pnm_fix_20041215.diff
- http://www.idefense.com/application/poi/display?id=176&type=vulnerabilities
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:011
- http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/input/pnm.c?r1=1.20&r2=1.21
More from mplayer
View All →CVE-2008-5616
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in...
Critical
10
CVE-2008-4610
MPlayer allows remote attackers to cause a denial of service...
Medium
5
CVE-2008-3827
Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer...
Critical
9.3
CVE-2008-1558
Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in...
Critical
10
CVE-2008-0630
Buffer overflow in url.c in MPlayer 1.0rc2 and SVN before...
Medium
6.8
Affected Vendor
mplayer
View all reports →Affected Software
mplayer, xine, xine-lib, mandrake linux
Vulnerable Versions:
0.90, 0.90_pre, 0.90_rc, 0.90_rc4, 0.91, 0.92, 0.92.1, 0.92_cvs, 1.0_pre1, 1.0_pre2, 1.0_pre3, 1.0_pre3try2, 1.0_pre4, 1.0_pre5, 1.0_pre5try1, 1.0_pre5try2, head_cvs, 0.9.8, 0.9.13, 0.9.18, 1_alpha, 1_beta1, 1_beta2, 1_beta3, 1_beta4, 1_beta5, 1_beta6, 1_beta7, 1_beta8, 1_beta9, 1_beta10, 1_beta11, 1_beta12, 1_rc0, 1_rc0a, 1_rc1, 1_rc2, 1_rc3, 1_rc3a, 1_rc3b, 1_rc4, 1_rc5, 1_rc6, 1_rc6a, 1_rc7, 1_rc8, 0.99, 1_rc3c, 10.0, 10.1
Timeline
Official Publish:
December 22nd, 2004
Last Modified:
August 8th, 2024
Added to House:
July 18th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.