Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2002-1896: Alsaplayer can let local users run any code
CVE-2002-1896 · published 23 years ago
Summary
If Alsaplayer version 0.99.71 is installed so it always runs with administrator privileges, a regular user can start it with a crafted command line and cause it to execute whatever program they choose. This could give that user higher access on the system. Remove the set‑administrator setting, upgrade to a fixed version, or uninstall Alsaplayer if it is not needed.
What to do
- Update debian alsaplayer to version 0.99.72-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | alsaplayer |
< 0.99.72-1 Fix: upgrade to 0.99.72-1
|
| Debian:13 | debian | alsaplayer |
< 0.99.72-1 Fix: upgrade to 0.99.72-1
|
| Debian:14 | debian | alsaplayer |
< 0.99.72-1 Fix: upgrade to 0.99.72-1
|
| – | alsaplayer | alsaplayer |
0.99.71 cpe:2.3:a:alsaplayer:alsaplayer:0.99.71:*:*:*:*:*:*:* |
Original advisory text
Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argument.
Buffer overflow in Alsaplayer 0.99.71, when installed setuid root, allows local users to execute arbitrary code via a long (1) -f or (2) -o command line argument.
References
- https://security-tracker.debian.org/tracker/CVE-2002-1896 Vendor Advisory
- http://alsaplayer.org/changelog.php3 Patch
- http://cvs.sourceforge.net/viewcvs.py/alsaplayer/alsaplayer/app/Main.cpp.diff?r1... Patch
- http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001730.html Patch
- http://www.iss.net/security_center/static/10157.php Patch
- http://www.securityfocus.com/bid/5767 Exploit Patch
Severity
7.2
High
Timeline
Published31 Dec 2002
Updated3 Nov 2026
First seen16 Sep 2026
Track software like this
Free during beta