CVE-2007-0017: videolan vlc_media_player

Vulnerability summary

CVE-2007-0017 is a medium (CVSS 6.8) vulnerability in videolan vlc_media_player. EPSS estimates a 12.37% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 03-01-2007
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.

• CWE-134Use of Externally-Controlled Format StringThe product uses a function that accepts a format string as an argument, but the format string originates from an external source.