PT-2022-5776 · Videolan+5 · Vlc Media Player+5
0Xmitsurugi
·
Published
2022-12-01
·
Updated
2024-06-15
·
CVE-2022-41325
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
VLC Media Player versions through 3.0.17.4
VLC Media Player versions through 3.0.18
Description
The issue is related to an integer overflow in the VNC module of the VLC Media Player. This can be exploited by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, potentially allowing a remote attacker to crash the player or execute arbitrary code under certain conditions.
Recommendations
For versions through 3.0.17.4, update to a version later than 3.0.17.4 to resolve the issue.
For versions through 3.0.18, update to a version later than 3.0.18 to resolve the issue.
As a temporary workaround, consider disabling the VNC module until a patch is available.
Restrict access to rogue VNC servers to minimize the risk of exploitation.
Avoid opening crafted playlists from untrusted sources until the issue is resolved.
Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Ubuntu
Vlc Media Player