Bug 780474 (CVE-2021-30145)

Summary:	<media-video/mpv-0.33.1: format string vulnerability (CVE-2021-30145)
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	gentoo, zlogene
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/mpv-player/mpv/releases/tag/v0.33.1
Whiteboard:	B2 [glsa+ cve]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2021-04-06 00:11:47 UTC

Not much detail here, but patch seems largely self explanatory:
https://github.com/mpv-player/mpv/compare/v0.33.0...v0.33.1

Fixed in 0.33.1. Please bump.

Comment 1 Sam James archtester

2021-05-18 17:15:32 UTC

Description:
"A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file."

Comment 2 John Helmert III archtester

2021-07-16 02:03:09 UTC

GLSA request filed.

Comment 3 GLSAMaker/CVETool Bot gentoo-dev

2021-07-20 04:18:28 UTC

This issue was resolved and addressed in
 GLSA 202107-46 at https://security.gentoo.org/glsa/202107-46
by GLSA coordinator John Helmert III (ajak).