PT-2011-1216 · Videolan · Vlc Media Player

Dan Rosenberg · Publicado 2011-01-03 · Atualizado 2024-06-15 · CVE-2010-3907

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VideoLAN VLC Media Player versions prior to 1.1.6

Description The issue is related to multiple integer overflows in the Real demuxer plugin, which can lead to a denial of service or possibly allow remote attackers to execute arbitrary code. This can occur through a zero i subpackets value in a Real Media file, resulting in a heap-based buffer overflow.

Recommendations For versions prior to 1.1.6, update to version 1.1.6 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Real demuxer plugin until a patch is available.

Correção

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2019-03976

CVE-2010-3907

OPENSUSE-SU-2024:10064-1

Produtos afetados

Vlc Media Player

Referências · 28

• https://osv.dev/vulnerability/openSUSE-SU-2024:10064-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-5108 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3907 · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-7981 · Nota
• https://git.videolan.org/?p=vlc.git;a=commit;h=6568965770f906d34d4aef83237842a5376adb55 · Nota
• http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=6568965770f906d34d4aef83237842a5376adb55 · Nota
• https://suse.com/security/cve/CVE-2015-8126 · Nota
• https://bdu.fstec.ru/vul/2019-03976 · Nota de Segurança
• https://suse.com/security/cve/CVE-2011-2588 · Nota
• https://suse.com/security/cve/CVE-2014-9625 · Nota
• http://securityfocus.com/bid/45632 · Nota
• https://osv.dev/vulnerability/CVE-2010-3907 · Aviso do Fabricante
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Aviso do Fabricante
• https://cvedetails.com/cve/CVE-2010-3907 · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-3907 · Aviso do Fabricante