PT-2012-2247 · Videolan · Vlc Media Player

Clement Lecigne · Published 2012-10-30 · Updated 2017-11-30 · CVE-2012-0023

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VideoLAN VLC media player versions 0.9.0 through 1.1.12

Description The issue is related to a double free vulnerability in the get chunk header function. This vulnerability allows remote attackers to cause a denial of service, resulting in the application crashing, and possibly execute arbitrary code via a crafted TiVo file.

Recommendations For versions 0.9.0 through 1.1.12, consider updating to a version that contains a fix for this issue, as using a crafted TiVo file could lead to a denial of service or arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2012-0023

Affected Products

Vlc Media Player

References · 16

• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0023 · Vendor Advisory
• http://secunia.com/advisories/47325 · Vendor Advisory
• http://videolan.org/security/sa1108.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-0023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0023 · Security Note
• https://osv.dev/vulnerability/CVE-2012-0023 · Vendor Advisory
• http://securityfocus.com/bid/51231 · Note
• http://openwall.com/lists/oss-security/2012/10/29/5 · Note
• http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=7d282fac1cc455b5a5eca2bb56375efcbf879b06 · Note
• http://osvdb.org/77975 · Note
• https://videolan.org/security/sa1108.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71916 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15893 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0023 · Note
• http://securitytracker.com/id?1026449 · Note