CVE-2006-2200

Medium

Published: 28/06/2006(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.31%

91th percentile - higher than 91% of all known CVEs

Summary

Stack-based buffer overflow in the libmms library, as used by MiMMS 0.0.9 and xine-lib 1.1.0 and earlier. A remote attacker can cause a denial of service (application crash) and possibly execute arbitrary code via the send_command, string_utf16, get_data, and get_media_packet functions.

Risk Assessment

Organizations using media players based on libmms may be targeted by attacks leading to remote code execution or application crashes. The risk is high because a crafted media stream is sufficient to trigger the vulnerability.

Recommendation

Update libmms and the MiMMS and xine-lib applications to the latest versions that contain the fix for this vulnerability. Avoid playing media from untrusted sources until patched.

Other vulnerabilities in libmms

CVE-2014-2892High
CVE-2014-2892 involves a heap-based buffer overflow in the get_answer function in mmsh.c in libmms before version 0.6.4. This allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Original NVD description (English source)

Stack-based buffer overflow in libmms, as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions.