PT-2013-3487 · Videolan · Vlc Media Player
Debasish Mandal
·
Published
2013-07-10
·
Updated
2017-09-19
·
CVE-2013-1954
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
VLC media player versions 2.0.5 and earlier
Description
The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read. When parsing a specially crafted ASF movie, a buffer overflow might occur, leading to a crash of VLC media player's process. In some cases, attackers might exploit this issue to execute arbitrary code within the context of the application.
Recommendations
For versions 2.0.5 and earlier, update to a version later than 2.0.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the ASF Demuxer module until a patch is available. Restrict access to crafted ASF movies to minimize the risk of exploitation.
Exploit
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vlc Media Player