CVE-2011-3623 — Improper Restriction of Operations within the Bounds of a Memory Buffer in VLC Media Player

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer5 documents5 sources

Severity

7.5HIGHNVD

EPSS

3.7%

top 12.05%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Videolan VLC Media Player

Timeline

PublishedDec 26

Latest updateMay 17

Description

Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via (1) a crafted ASF file, related to the ASF_ObjectDumpDebug function in modules/demux/asf/libasf.c; (2) a crafted AVI file, related to the AVI_ChunkDumpDebug_level function in modules/demux/avi/libavi.c; or (3) a crafted MP4 file, related to the __MP4_BoxDumpStructure function in modules/demux/mp4/libmp4.c.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶Debianvideolan/vlc_media_player< 1.1.3-1+3

▶NVDvideolan/vlc_media_player1.0.1+39

🔴Vulnerability Details

GHSA

GHSA-64pw-5m9v-5q76: Multiple stack-based buffer overflows in VideoLAN VLC media player before 1↗2022-05-17

▶

CVEList

CVE-2011-3623: Multiple stack-based buffer overflows in VideoLAN VLC media player before 1↗2014-12-26

▶

OSV

CVE-2011-3623: Multiple stack-based buffer overflows in VideoLAN VLC media player before 1↗2014-12-26

▶

📋Vendor Advisories

Debian

CVE-2011-3623: vlc - Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 ...↗2011

▶