PT-2011-3940 · Videolan · Vlc Media Player

Published 2011-07-26 · Updated 2024-06-15 · CVE-2011-2588

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VLC media player versions prior to 1.1.11

Description A heap-based buffer overflow issue exists in the AVI demuxer, specifically in the AVI ChunkRead strf function in libavi.c. This is due to an integer underflow error when parsing the strf chunk within AVI files, which can be exploited to cause a heap-based buffer overflow. Successful exploitation allows execution of arbitrary code, potentially compromising a user's system.

Recommendations For versions prior to 1.1.11, update to version 1.1.11 or later to resolve the issue. As a temporary workaround, consider avoiding the use of AVI files or restricting access to potentially malicious AVI media files until the update is applied.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-2588

OPENSUSE-SU-2024:10064-1

Affected Products

Vlc Media Player

References · 21

• https://osv.dev/vulnerability/openSUSE-SU-2024:10064-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2588 · Vendor Advisory
• http://videolan.org/security/sa1106.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2588 · Vendor Advisory
• http://secunia.com/advisories/45066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2588 · Security Note
• https://osv.dev/vulnerability/CVE-2011-2588 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-5108 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2588 · Note
• https://suse.com/security/cve/CVE-2015-7981 · Note
• https://suse.com/security/cve/CVE-2015-8126 · Note
• https://suse.com/security/cve/CVE-2011-2588 · Note
• https://suse.com/security/cve/CVE-2014-9625 · Note
• https://suse.com/security/cve/CVE-2011-2587 · Note
• http://securityfocus.com/bid/48664 · Note