PT-2007-7481 · Videolan+1 · Vlc Media Player+6

Published 1970-01-01 · Updated 2018-10-16 · CVE-2007-3467

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VLC Media Player versions prior to 0.8.6c libvlc0-dev (affected versions not specified) libvlc0 (affected versions not specified) wxvlc (affected versions not specified) gvlc (affected versions not specified) gnome-vlc (affected versions not specified)

Description The issue concerns multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libvlc0-dev, libvlc0, wxvlc, gvlc, and gnome-vlc. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in the status Update function in stats.c of VideoLAN VLC Media Player before version 0.8.6c allows remote attackers to cause a denial of service via a WAV file with a large sample rate.

Recommendations For VLC Media Player versions prior to 0.8.6c: Update to version 0.8.6c or later to resolve the issue. For libvlc0-dev: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For libvlc0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For wxvlc: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For gvlc: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For gnome-vlc: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-01753

BDU:2015-01754

BDU:2015-01755

BDU:2015-01756

BDU:2015-01765

CVE-2007-3467

DSA-1332-1

Affected Products

Debian

Vlc Media Player

Gnome-Vlc

Gvlc

Libvlc0

Libvlc0-Dev

Wxvlc

References · 21

• https://bdu.fstec.ru/vul/2015-01753 · Security Note
• http://isecpartners.com/advisories/2007-001-vlc.txt · Patch
• https://security-tracker.debian.org/tracker/CVE-2007-3467 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3467 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3468 · Security Note
• https://bdu.fstec.ru/vul/2015-01756 · Security Note
• https://bdu.fstec.ru/vul/2015-01765 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3316 · Security Note
• https://bdu.fstec.ru/vul/2015-01754 · Security Note
• https://bdu.fstec.ru/vul/2015-01755 · Security Note
• http://debian.org/security/2007/dsa-1332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3467 · Security Note
• https://osv.dev/vulnerability/CVE-2007-3467 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3467 · Vendor Advisory
• http://securityfocus.com/archive/1/471933/100/0/threaded · Note