CVE-2007-1246
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier...
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
Exploit likelihood
What each source reports
NVD Score used
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
- Record
CVE-2007-1246- CVSS 2.0
- 7.6 High
AV:N/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
- Record
CVE-2007-1246- Updated
- 2026-11-02
EUVDEUVD-2007-1243 No score
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
- Record
EUVD-2007-1243- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p2g2-cx5m-mpwf No score
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier...
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
- Record
GHSA-p2g2-cx5m-mpwf- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
- Record
CVE-2007-1246- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-1246 No score
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
- Record
DEBIAN-CVE-2007-1246- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mplayerDebian:12 |
before 1.0~rc1-13 | 1.0~rc1-13 |
mplayerDebian:13 |
before 1.0~rc1-13 | 1.0~rc1-13 |
mplayerDebian:14 |
before 1.0~rc1-13 | 1.0~rc1-13 |
xine-libDebian:3.1 |
before 1.0.1-1sarge7, plus listed versions 1.0.1-11.0.1-1sarge11.0.1-1sarge21.0.1-1sarge31.0.1-1sarge41.0.1-1sarge51.0.1-1sarge6 |
1.0.1-1sarge7 |
xine-libDebian:4.0 |
before 1.1.2+dfsg-6, plus listed versions 1.1.2+dfsg-41.1.2+dfsg-5 |
1.1.2+dfsg-6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1246 is a high vulnerability (CVSS 7.6) in Mplayer, published March 3, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.74%, the 93rd percentile. Fixed in mplayer 1.0~rc1-13.
References
svn.mplayerhq.hu/mplayer/trunk/loader/dmo/DMO_VideoDecoder.c
lists.grok.org.uk/pipermail/full-disclosure/2007-March/052738.html
novell.com/linux/security/advisories/2007_5_sr.html
mandriva.com/security/advisories?name=MDKSA-2007:057
securityfocus.com/archive/1/466691/30/6900/threaded
Show 23 moreShow less
secunia.com/advisories/24995
ubuntu.com/usn/usn-433-1
vupen.com/english/advisories/2007/0794
exchange.xforce.ibmcloud.com/vulnerabilities/32747
debian.org/security/2008/dsa-1536
security.gentoo.org/glsa/glsa-200704-09.xml
slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.449141
nvd.nist.gov/vuln/detail/CVE-2007-1246
github.com/advisories/GHSA-p2g2-cx5m-mpwf
security-tracker.debian.org/tracker/CVE-2007-1246