CVE-2008-5276
published 2008-12-03CVE-2008-5276: Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to…
PriorityP346critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
7.84%
93.9th percentile
Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | vlc | < vlc 0.9.8a-1 (bookworm) | vlc 0.9.8a-1 (bookworm) |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | >= 0 < 0.9.8a-1 | 0.9.8a-1 |
| videolan | vlc_media_player | >= 0 < 0.9.8a-1 | 0.9.8a-1 |
| videolan | vlc_media_player | >= 0 < 0.9.8a-1 | 0.9.8a-1 |
| videolan | vlc_media_player | >= 0 < 0.9.8a-1 | 0.9.8a-1 |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv9.3CRITICAL
vendor_debian9.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gj6f-7h35-44xq: Integer overflow in the ReadRealIndex function in real
ghsa_unreviewed·2022-05-14
CVE-2008-5276 [HIGH] GHSA-gj6f-7h35-44xq: Integer overflow in the ReadRealIndex function in real
Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.
OSV
CVE-2008-5276: Integer overflow in the ReadRealIndex function in real
osv·2008-12-03·CVSS 9.3
CVE-2008-5276 [CRITICAL] CVE-2008-5276: Integer overflow in the ReadRealIndex function in real
Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.
Debian
CVE-2008-5276: vlc - Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plu...
vendor_debian·2008·CVSS 9.3
CVE-2008-5276 [CRITICAL] CVE-2008-5276: vlc - Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plu...
Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.
Scope: local
bookworm: resolved (fixed in 0.9.8a-1)
bullseye: resolved (fixed in 0.9.8a-1)
forky: resolved (fixed in 0.9.8a-1)
sid: resolved (fixed in 0.9.8a-1)
trixie: resolved (fixed in 0.9.8a-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d19de4e9f2211cbe5bde00726b66c47a424f4e07http://secunia.com/advisories/32942http://secunia.com/advisories/33315http://security.gentoo.org/glsa/glsa-200812-24.xmlhttp://securityreason.com/securityalert/4680http://www.osvdb.org/50333http://www.securityfocus.com/archive/1/498768/100/0/threadedhttp://www.securityfocus.com/bid/32545http://www.trapkit.de/advisories/TKADV2008-013.txthttp://www.videolan.org/security/sa0811.htmlhttp://www.vupen.com/english/advisories/2008/3287https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14793http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=d19de4e9f2211cbe5bde00726b66c47a424f4e07http://secunia.com/advisories/32942http://secunia.com/advisories/33315http://security.gentoo.org/glsa/glsa-200812-24.xmlhttp://securityreason.com/securityalert/4680http://www.osvdb.org/50333http://www.securityfocus.com/archive/1/498768/100/0/threadedhttp://www.securityfocus.com/bid/32545http://www.trapkit.de/advisories/TKADV2008-013.txthttp://www.videolan.org/security/sa0811.htmlhttp://www.vupen.com/english/advisories/2008/3287https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14793
2008-12-03
Published