Search for vulnerabilities
Vulnerability details: VCID-wey5-fv2r-aaaa
Vulnerability ID VCID-wey5-fv2r-aaaa
Aliases CVE-2008-0486
Summary Array index vulnerability in libmpdemux/demux_audio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-189 Numeric Errors
System Score Found at
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.0457 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.07229 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.11118 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.29188 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.29188 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.29188 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
epss 0.36094 https://api.first.org/data/v1/epss?cve=CVE-2008-0486
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2008-0486
Reference id Reference type URL
http://bugs.gentoo.org/show_bug.cgi?id=209106
http://bugs.xine-project.org/show_bug.cgi?id=38
http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060033.html
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-0486.json
https://api.first.org/data/v1/epss?cve=CVE-2008-0486
https://bugzilla.redhat.com/show_bug.cgi?id=431541
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0486
http://secunia.com/advisories/28779
http://secunia.com/advisories/28801
http://secunia.com/advisories/28918
http://secunia.com/advisories/28955
http://secunia.com/advisories/28956
http://secunia.com/advisories/28989
http://secunia.com/advisories/29141
http://secunia.com/advisories/29307
http://secunia.com/advisories/29323
http://secunia.com/advisories/29601
http://secunia.com/advisories/31393
http://security.gentoo.org/glsa/glsa-200802-12.xml
http://security.gentoo.org/glsa/glsa-200803-16.xml
http://securityreason.com/securityalert/3608
http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=574735
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00395.html
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00442.html
http://www.coresecurity.com/?action=item&id=2103
http://www.debian.org/security/2008/dsa-1496
http://www.debian.org/security/2008/dsa-1536
http://www.mandriva.com/security/advisories?name=MDVSA-2008:045
http://www.mandriva.com/security/advisories?name=MDVSA-2008:046
http://www.mplayerhq.hu/design7/news.html
http://www.securityfocus.com/archive/1/487501/100/0/threaded
http://www.securityfocus.com/bid/27441
http://www.ubuntu.com/usn/usn-635-1
http://www.vupen.com/english/advisories/2008/0406/references
http://www.vupen.com/english/advisories/2008/0421
464060 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464060
cpe:2.3:a:mplayer:mplayer:1.02rc2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mplayer:mplayer:1.02rc2:*:*:*:*:*:*:*
cpe:2.3:a:xine:xine-lib:1.1.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:xine:xine-lib:1.1.10:*:*:*:*:*:*:*
CVE-2008-0486 https://nvd.nist.gov/vuln/detail/CVE-2008-0486
GLSA-200802-12 https://security.gentoo.org/glsa/200802-12
GLSA-200803-16 https://security.gentoo.org/glsa/200803-16
USN-635-1 https://usn.ubuntu.com/635-1/
No exploits are available.
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2008-0486
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.88192
EPSS Score 0.0457
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.