CVE-2006-6172

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-11-30 · updated 2026-06-16

Description

Buffer overflow in the asmrp_eval function in the RealMedia RTSP stream handler (asmrp.c) for Real Media input plugin, as used in (1) xine/xine-lib, (2) MPlayer 1.0rc1 and earlier, and possibly others, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a rulebook with a large number of rulematches.

Affected products

Mplayer: through 1.0_rc1
Xine Real Media Input Plugin: all versions

References

http://secunia.com/advisories/23218
http://secunia.com/advisories/23242
http://secunia.com/advisories/23249
http://secunia.com/advisories/23301
http://secunia.com/advisories/23335
http://secunia.com/advisories/23512
http://secunia.com/advisories/23567
http://secunia.com/advisories/24336
http://secunia.com/advisories/24339
http://secunia.com/advisories/25555
http://security.gentoo.org/glsa/glsa-200612-02.xml
http://security.gentoo.org/glsa/glsa-200702-11.xml

Get alerted when CVE-2006-6172 or the next vulnerability affects your stack