Videolan vulnerabilities, page 4

137 vulnerabilities

Known vulnerabilities in Videolan products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.

6.8MediumCVE-2008-4558debian · vlc +1 moredebian vlcArray index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a signed comparison.EPSS8.49%9.3CriticalCVE-2008-4654debian · vlc +1 moredebian vlcStack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.EPSS57.55%9.3CriticalCVE-2008-5036debian · vlc +1 moredebian vlcStack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.EPSS41.44%9.3CriticalCVE-2008-5032debian · vlc +1 moredebian vlcStack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. NOTE: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier, CVE-2008-5036.EPSS10.67%9.3CriticalCVE-2008-5276debian · vlc +1 moredebian vlcInteger overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.EPSS7.84%9.3CriticalCVE-2008-3732debian · vlc +1 moredebian vlcInteger overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TTA file, which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.EPSS13.43%6.8MediumCVE-2008-3794debian · vlc +1 moredebian vlcInteger signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers to execute arbitrary code via a crafted mmst link with a negative size value, which bypasses a size check and triggers an integer overflow followed by a heap-based buffer overflow.EPSS11.04%7.8HighCVE-2022-41325debian · vlc +6 moredebian vlcAn integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.EPSS0.68%4.3MediumCVE-2012-2396debian · taglib +2 moredebian taglibVideoLAN VLC media player 2.0.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted MP4 file.EPSS7.21%9.3CriticalCVE-2012-1775debian · vlc +1 moredebian vlcStack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream.EPSS44.12%9.3CriticalCVE-2012-1776debian · vlc +1 moredebian vlcMultiple heap-based buffer overflows in VideoLAN VLC media player before 2.0.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real RTSP stream.EPSS5.26%9.3CriticalCVE-2012-0023debian · vlc +1 moredebian vlcDouble free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.EPSS4.92%4.3MediumCVE-2012-0904videolan · vlc_media_playervideolan vlc_media_playerVLC media player 1.1.11 allows remote attackers to cause a denial of service (crash) via a long string in an amr file.EPSS4.84%4.3MediumCVE-2012-5470debian · vlc +1 moredebian vlclibpng_plugin in VideoLAN VLC media player 2.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted PNG file.EPSS5.85%4.3MediumCVE-2012-5855videolan · vlc_media_playervideolan vlc_media_playerThe SHAddToRecentDocs function in VideoLAN VLC media player 2.0.4 and earlier might allow user-assisted attackers to cause a denial of service (crash) via a crafted file name that triggers an incorrect string-length calculation when the file is added to VLC. NOTE: it is not clear whether this issue crosses privilege boundaries or whether it can be exploited without user interaction.EPSS1.21%6.8MediumCVE-2012-3377debian · vlc +1 moredebian vlcHeap-based buffer overflow in the Ogg_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.EPSS3.80%6.8MediumCVE-2011-2588debian · vlc +1 moredebian vlcHeap-based buffer overflow in the AVI_ChunkRead_strf function in libavi.c in the AVI demuxer in VideoLAN VLC media player before 1.1.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted AVI media file.EPSS3.69%6.8MediumCVE-2011-2587debian · vlc +1 moredebian vlcHeap-based buffer overflow in the DemuxAudioSipr function in real.c in the RealMedia demuxer in VideoLAN VLC media player 1.1.x before 1.1.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real Media file.EPSS3.69%9.3CriticalCVE-2011-2194debian · vlc +1 moredebian vlcInteger overflow in the XSPF playlist parser in VideoLAN VLC media player 0.8.5 through 1.1.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a heap-based buffer overflow.EPSS9.18%6.8MediumCVE-2011-1931ffmpeg +2 moreffmpeg ffmpegsp5xdec.c in the Sunplus SP5X JPEG decoder in libavcodec in FFmpeg before 0.6.3 and libav through 0.6.2, as used in VideoLAN VLC media player 1.1.9 and earlier and other products, performs a write operation outside the bounds of an unspecified array, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a malformed AMV file.EPSS2.23%