cbcvebase.
CVE-2013-1868
published 2013-07-10

CVE-2013-1868: Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code…

PriorityP355critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
10.98%
95.3th percentile
Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.

Affected

10 ranges
VendorProductVersion rangeFixed in
debianvlc< vlc 2.0.5-1 (bookworm)vlc 2.0.5-1 (bookworm)
videolanvlc_media_player<= 2.0.4—
videolanvlc_media_player——
videolanvlc_media_player——
videolanvlc_media_player——
videolanvlc_media_player——
videolanvlc_media_player>= 0 < 2.0.5-12.0.5-1
videolanvlc_media_player>= 0 < 2.0.5-12.0.5-1
videolanvlc_media_player>= 0 < 2.0.5-12.0.5-1
videolanvlc_media_player>= 0 < 2.0.5-12.0.5-1

Detection & IOCsextracted from sources · hover to see the quote

filename.swf↗
  • →Attack surface includes the freetype renderer and HTML subtitle parser in VLC ≤ 2.0.4; flag subtitle files (.srt, .html) and .swf files fed to vulnerable VLC versions ↗
  • →Faulting call stack passes through libavcodec_plugin and libvlccore; alert on VLC child-process crashes involving these DLLs with a DEP violation event ↗
  • ·PoC was tested only on Windows XP SP3 (x86 user mode); exploitability on other platforms or OS versions is unconfirmed from these sources ↗
  • ·The vulnerability is fixed in VLC 2.0.5-1 (Debian); detections targeting the crash path are only relevant for VLC ≤ 2.0.4 ↗

CVSS provenance

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv9.3CRITICAL
vendor_debian9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.