PT-2007-7441 · Videolan · Vlc Media Player

Published 2007-04-10 · Updated 2017-09-19 · CVE-2011-1087

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VideoLAN VLC media player version 1.0.5

Description The issue allows user-assisted remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code. This can be achieved via a crafted .mp3 file that is played during bookmark creation. The exploitation requires active actions from the user side.

Recommendations For version 1.0.5, consider avoiding the use of bookmark creation with .mp3 files until a patch is available. As a temporary workaround, restrict the playback of .mp3 files to minimize the risk of exploitation.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-1087

Affected Products

Vlc Media Player

References · 14

• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2010-4931.php · Exploit
• 🔥 http://securityfocus.com/bid/38569 · Exploit
• http://secunia.com/advisories/38853 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-1087 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1087 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-1087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1087 · Security Note
• http://openwall.com/lists/oss-security/2011/03/03/9 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14532 · Note
• http://openwall.com/lists/oss-security/2011/03/28/7 · Note
• http://osvdb.org/62728 · Note
• http://openwall.com/lists/oss-security/2011/03/03/8 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1087 · Note
• http://openwall.com/lists/oss-security/2011/03/02/3 · Note