CVE-2008-1881: videolan vlc

Modified

AliasesDEBIAN-CVE-2008-1881

Published 17-04-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-1881 is a medium (CVSS 6.8) vulnerability in videolan vlc. EPSS estimates a 11.78% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 23-05-2008)

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

11.78%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2exploit-database

Advisory lineage

Upstream 0 · Downstream 2

DSA-1819-1 DTSA-125-1

Timeline

17-04-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary code via a long subtitle in an SSA file. NOTE: this issue is due to an incomplete fix for CVE-2007-6681.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

11.78%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 11.78% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

exploit-databaselocalwindowsVerified
VideoLAN VLC Media Player 0.8.6d SSA Parsing Double Sh311 - Universal
Maturity: weaponized
exploit-databaselocalwindowsVerified
VideoLAN VLC Media Player 0.8.6e - Subtitle Parsing Local Buffer Overflow
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

vlc< 0.8.6.e-2.1

Videolan1 product

vlc0.8.6e

2 vendors · 2 products

References

14 links

exchange.xforce.ibmcloud.com/vulnerabilities/41936VDB EntryX Refsource XF
aluigi.org/adv/vlcboffs-adv.txtX Refsource MISC
www.securityfocus.com/archive/1/489698Mailing ListX Refsource BUGTRAQ
secunia.com/advisories/28233Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200804-25.xmlVendor AdvisoryX Refsource GENTOO
wiki.videolan.org/Changelog/0.8.6fX Refsource CONFIRM
www.securityfocus.com/bid/28274VDB EntryX Refsource BID
secunia.com/advisories/29800Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14872VDB EntrySignatureX Refsource OVAL
www.exploit-db.com/exploits/5250ExploitX Refsource EXPLOIT DB

Show all 14 references

exchange.xforce.ibmcloud.com/vulnerabilities/41237VDB EntryX Refsource XF
aluigi.altervista.org/adv/vlcboffs-adv.txtX Refsource MISC
www.securityfocus.com/bid/28251VDB EntryX Refsource BID
security-tracker.debian.org/tracker/CVE-2008-1881Advisory