Quoting the webpage of Sven Tantau who found the vulnerability: "Affected Version: 1.0_pre7 (tested), 1.0_pre6-r4 (tested), 1.0pre6-3.3.5-20050130 (confirmed) <...> For high values of the 2 bytes strf parameter in the audio header of a video file, it is possible to overflow sh_audio->a_buffer, overwrite the instruction pointer and execute arbitrary code <...> MPlayer developers patched the problem: http://www1.mplayerhq.hu/cgi-bin/cvsweb.cgi/main/libmpcodecs/ad_pcm.c.diff?r1=1.18&r2=1.19" The patch applies cleanly to media-video/mplayer-1.0-pre7 Reproducible: Always Steps to Reproduce:
*** This bug has been marked as a duplicate of 103555 ***