CVE-2010-2062
published 2014-12-26CVE-2010-2062: Integer underflow in the real_get_rdt_chunk function in real.c, as used in modules/access/rtsp/real.c in VideoLAN VLC media player before 1.0.1 and…
PriorityP344high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
4.40%
90.1th percentile
Integer underflow in the real_get_rdt_chunk function in real.c, as used in modules/access/rtsp/real.c in VideoLAN VLC media player before 1.0.1 and stream/realrtsp/real.c in MPlayer before r29447, allows remote attackers to execute arbitrary code via a crafted length value in an RDT chunk header.
Affected
49 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mplayer | < mplayer 2:1.0~rc3+svn20100502-3 (bookworm) | mplayer 2:1.0~rc3+svn20100502-3 (bookworm) |
| debian | vlc | < mplayer 2:1.0~rc3+svn20100502-3 (bookworm) | mplayer 2:1.0~rc3+svn20100502-3 (bookworm) |
| mplayer | mplayer | >= 0 < 2:1.0~rc3+svn20100502-3 | 2:1.0~rc3+svn20100502-3 |
| mplayer | mplayer | >= 0 < 2:1.0~rc3+svn20100502-3 | 2:1.0~rc3+svn20100502-3 |
| mplayer | mplayer | >= 0 < 2:1.0~rc3+svn20100502-3 | 2:1.0~rc3+svn20100502-3 |
| mplayer | mplayer | >= 0 < 2:1.0~rc3+svn20100502-3 | 2:1.0~rc3+svn20100502-3 |
| videolan | vlc_media_player | <= 1.0.0 | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
| videolan | vlc_media_player | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pp8c-mm4f-pg89: Integer underflow in the real_get_rdt_chunk function in real
ghsa_unreviewed·2022-05-17
CVE-2010-2062 [HIGH] GHSA-pp8c-mm4f-pg89: Integer underflow in the real_get_rdt_chunk function in real
Integer underflow in the real_get_rdt_chunk function in real.c, as used in modules/access/rtsp/real.c in VideoLAN VLC media player before 1.0.1 and stream/realrtsp/real.c in MPlayer before r29447, allows remote attackers to execute arbitrary code via a crafted length value in an RDT chunk header.
OSV
CVE-2010-2062: Integer underflow in the real_get_rdt_chunk function in real
osv·2014-12-26·CVSS 7.5
CVE-2010-2062 [HIGH] CVE-2010-2062: Integer underflow in the real_get_rdt_chunk function in real
Integer underflow in the real_get_rdt_chunk function in real.c, as used in modules/access/rtsp/real.c in VideoLAN VLC media player before 1.0.1 and stream/realrtsp/real.c in MPlayer before r29447, allows remote attackers to execute arbitrary code via a crafted length value in an RDT chunk header.
Debian
CVE-2010-2062: mplayer - Integer underflow in the real_get_rdt_chunk function in real.c, as used in modul...
vendor_debian·2010·CVSS 7.5
CVE-2010-2062 [HIGH] CVE-2010-2062: mplayer - Integer underflow in the real_get_rdt_chunk function in real.c, as used in modul...
Integer underflow in the real_get_rdt_chunk function in real.c, as used in modules/access/rtsp/real.c in VideoLAN VLC media player before 1.0.1 and stream/realrtsp/real.c in MPlayer before r29447, allows remote attackers to execute arbitrary code via a crafted length value in an RDT chunk header.
Scope: local
bookworm: resolved (fixed in 2:1.0~rc3+svn20100502-3)
bullseye: resolved (fixed in 2:1.0~rc3+svn20100502-3)
forky: resolved (fixed in 2:1.0~rc3+svn20100502-3)
sid: resolved (fixed in 2:1.0~rc3+svn20100502-3)
trixie: resolved (fixed in 2:1.0~rc3+svn20100502-3)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=dc74600c97eb834c08674676e209afa842053acahttp://openwall.com/lists/oss-security/2010/06/04/4http://seclists.org/fulldisclosure/2009/Jul/418https://dzcore.wordpress.com/2009/07/27/dzc-2009-001-the-movie-player-and-vlc-media-player-real-data-transport-parsing-integer-underflow/http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=dc74600c97eb834c08674676e209afa842053acahttp://openwall.com/lists/oss-security/2010/06/04/4http://seclists.org/fulldisclosure/2009/Jul/418https://dzcore.wordpress.com/2009/07/27/dzc-2009-001-the-movie-player-and-vlc-media-player-real-data-transport-parsing-integer-underflow/
2014-12-26
Published