CVE-2008-5616
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1...
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
Exploit likelihood
What each source reports
NVD Score used
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
- Record
CVE-2008-5616- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
- Record
CVE-2008-5616- Updated
- 2026-11-02
EUVDEUVD-2008-5591 No score
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
- Record
EUVD-2008-5591- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w9vw-r38j-pm48 No score
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1...
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
- Record
GHSA-w9vw-r38j-pm48- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
- Record
CVE-2008-5616- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-5616 No score
Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.
- Record
DEBIAN-CVE-2008-5616- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mplayerDebian:12 |
before 1.0~rc2-19 | 1.0~rc2-19 |
mplayerDebian:13 |
before 1.0~rc2-19 | 1.0~rc2-19 |
mplayerDebian:14 |
before 1.0~rc2-19 | 1.0~rc2-19 |
mplayerDebian:4.0 From an advisory covering 3 CVEs |
before 1.0~rc1-12etch7, plus listed versions 1.0~rc1-12etch1.0~rc1-12etch11.0~rc1-12etch21.0~rc1-12etch31.0~rc1-12etch5 |
1.0~rc1-12etch7 |
mplayerDebian:5.0 From an advisory covering 2 CVEs |
before 1.0~rc2-17+lenny2 | 1.0~rc2-17+lenny2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5616 is a high vulnerability (CVSS 10.0) in Mplayer, published December 17, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.69%, the 94th percentile. Fixed in mplayer 1.0~rc2-19.
References
secunia.com/advisories/34845
mandriva.com/security/advisories?name=MDVSA-2009:014
securityfocus.com/bid/32822
svn.mplayerhq.hu/mplayer/branches/1.0rc2/libmpdemux/demux_vqf.c?r1=24723&r2=28150&pathrev=28150
Show 7 moreShow less
debian.org/security/2009/dsa-1782
trapkit.de/advisories/TKADV2008-014.txt
nvd.nist.gov/vuln/detail/CVE-2008-5616
github.com/advisories/GHSA-w9vw-r38j-pm48
security-tracker.debian.org/tracker/CVE-2008-5616