PT-2011-3291 · Videolan · Vlc Media Player

Published 2011-05-03 · Updated 2017-09-19 · CVE-2011-1684

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VLC media player versions 1.x through 1.1.8 VLC media player versions prior to 1.1.9

Description The issue is related to a heap-based buffer overflow in the MP4 ReadBox skcr function in libmp4.c in the MP4 demultiplexer. This allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.

Recommendations For VLC media player versions 1.x through 1.1.8, update to version 1.1.9 or later. For VLC media player versions prior to 1.1.9, update to version 1.1.9 or later. As a temporary workaround, consider avoiding the use of the MP4 demultiplexer until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-1684

DSA-2218-1

Affected Products

Vlc Media Player

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2011-1684 · Security Note
• http://debian.org/security/2011/dsa-2218 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-1684 · Vendor Advisory
• http://secunia.com/advisories/43890 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0954 · Vendor Advisory
• http://videolan.org/security/sa1103.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/04/13/14 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1684 · Vendor Advisory
• http://secunia.com/advisories/44022 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0916 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-1684 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/04/11/17 · Patch
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14741 · Note
• http://securitytracker.com/id?1025373 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1684 · Note