PT-2013-3487 · Videolan · Vlc Media Player
Debasish Mandal
·
Publicado
2013-07-10
·
Atualizado
2017-09-19
·
CVE-2013-1954
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
VLC media player versions 2.0.5 and earlier
Description
The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read. When parsing a specially crafted ASF movie, a buffer overflow might occur, leading to a crash of VLC media player's process. In some cases, attackers might exploit this issue to execute arbitrary code within the context of the application.
Recommendations
For versions 2.0.5 and earlier, update to a version later than 2.0.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the ASF Demuxer module until a patch is available. Restrict access to crafted ASF movies to minimize the risk of exploitation.
Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Vlc Media Player