PT-2011-1216 · Videolan · Vlc Media Player

Dan Rosenberg · Published 2011-01-03 · Updated 2024-06-15 · CVE-2010-3907

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VideoLAN VLC Media Player versions prior to 1.1.6

Description The issue is related to multiple integer overflows in the Real demuxer plugin, which can lead to a denial of service or possibly allow remote attackers to execute arbitrary code. This can occur through a zero i subpackets value in a Real Media file, resulting in a heap-based buffer overflow.

Recommendations For versions prior to 1.1.6, update to version 1.1.6 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Real demuxer plugin until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2019-03976

CVE-2010-3907

OPENSUSE-SU-2024:10064-1

Affected Products

Vlc Media Player

References · 28

• https://osv.dev/vulnerability/openSUSE-SU-2024:10064-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3907 · Security Note
• https://bdu.fstec.ru/vul/2019-03976 · Security Note
• https://osv.dev/vulnerability/CVE-2010-3907 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-3907 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3907 · Vendor Advisory
• http://videolan.org/security/sa1007.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/3345 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-5108 · Note
• https://suse.com/security/cve/CVE-2015-7981 · Note
• https://git.videolan.org/?p=vlc.git;a=commit;h=6568965770f906d34d4aef83237842a5376adb55 · Note
• http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=6568965770f906d34d4aef83237842a5376adb55 · Note
• https://suse.com/security/cve/CVE-2015-8126 · Note
• https://suse.com/security/cve/CVE-2011-2588 · Note