Debian Vlc vulnerabilities

CVE-2011-1087 [HIGH] CVE-2011-1087: vlc - Buffer overflow in VideoLAN VLC media player 1.0.5 allows user-assisted remote a... Buffer overflow in VideoLAN VLC media player 1.0.5 allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .mp3 file that is played during bookmark creation. Scope: local bookworm: resolved (fixed in 1.1.10-1) bullseye: resolved (fixed in 1.1.10-1) forky: resolved (fixed

CVE-2020-6078 [HIGH] CVE-2020-6078: libmicrodns - An exploitable denial-of-service vulnerability exists in the message-parsing fun... An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_recv, the return value of the mdns_read_header function is not checked, leading to an uninitialized variable usage that eventually results in a null pointer dereference, leading to service crash. An attacker

CVE-2014-9628 [HIGH] CVE-2014-9628: vlc - The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC me... The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks, and consequently execute arbitrary code, via a box size of 7. Scope: local bookworm: resolved (fixed in 2.2.0~rc2-2) bullseye: resolved (fixed in 2.2.0~rc2-2) forky: r

CVE-2019-5439 [MEDIUM] CVE-2019-5439: vlc - A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly ... A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit. Scope: local bookworm: resolved (fixed in 3.0.7-1) bullseye: resolved (fixed in 3.0.7-1) forky: resolved (fixed in 3.0.7-1) sid: resolved (fixed in 3.0.7-1) trixie: resolved (fixed in 3.0.7-1)

CVE-2019-14970 [HIGH] CVE-2019-14970: vlc - A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allo... A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file. Scope: local bookworm: resolved (fixed in 3.0.8-1) bullseye: resolved (fixed in 3.0.8-1) forky: resolved (fixed in 3.0.8-1) sid: resolved (fixed in 3.0.8-1) trixie: resolved (fixed in 3.0.8-1)

CVE-2019-14438 [HIGH] CVE-2019-14438: vlc - A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in V... A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer over-read via a crafted .ogg file. Scope: local bookworm: resolved (fixed in 3.0.8-1) bullseye: resolved (fixed in 3.0.8-1) forky: resolved (fixed in 3.0.8-1) sid: resolved (fixed in 3.0.8-1) trixie: reso

CVE-2020-6073 [HIGH] CVE-2020-6073: libmicrodns - An exploitable denial-of-service vulnerability exists in the TXT record-parsing ... An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing the RDATA section in a TXT record in mDNS messages, multiple integer overflows can be triggered, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability. Scope: local forky: resolved (

CVE-2018-11516 [HIGH] CVE-2018-11516: vlc - The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC m... The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted .swf file. Scope: local bookworm: resolved (fixed in 3.0.2-1) bullseye: resolved (fixed in 3.0.2-1) forky: resolved (fixed in

CVE-2010-1444 [HIGH] CVE-2010-1444: vlc - The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows re... The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive. Scope: local bookworm: resolved (fixed in 1.0.6-1) bullseye: resolved (fixed in 1.0.6-1) forky: resolved (fixed in 1.0.6-1) sid: resolved (fixed i

CVE-2010-1442 [HIGH] CVE-2010-1442: vlc - VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial... VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer. Scope: local bookworm: resolved (fixed in 1.0.6-1) bullseye: resolved (fixed in 1.0.6-1) forky: resolved (fixed in

CVE-2020-6071 [HIGH] CVE-2020-6071: libmicrodns - An exploitable denial-of-service vulnerability exists in the resource record-par... An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability. Scope: local forky

CVE-2019-14437 [HIGH] CVE-2019-14437: vlc - The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media pla... The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file. Scope: local bookworm: resolved (fixed in 3.0.8-1) bullseye: resolved (fixed in 3.0.8-1) forky: resolved (fixed in 3.0.8-1) sid: resolved (fixed in 3.0.8-1)

CVE-2010-1441 [HIGH] CVE-2010-1441: vlc - Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 a... Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) A/52, (2) DTS, or (3) MPEG Audio decoder. Scope: local bookworm: resolved (fixed in 1.0.6-1) bullseye: resolved (fixed in 1.0.6-1) forky: resolved (fix

CVE-2010-1445 [HIGH] CVE-2010-1445: vlc - Heap-based buffer overflow in VideoLAN VLC media player before 1.0.6 allows remo... Heap-based buffer overflow in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream in an RTMP session. Scope: local bookworm: resolved (fixed in 1.0.6-1) bullseye: resolved (fixed in 1.0.6-1) forky: resolved (fixed in 1.0.6-1) sid: resolved (fixed in 1.0

CVE-2020-13428 [HIGH] CVE-2020-13428: vlc - A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packe... A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file. Scope: local bookworm: resolved (fixed in 3.0.11-1) bullseye

CVE-2019-13602 [HIGH] CVE-2019-13602: vlc - An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in Video... An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file. Scope: local bookworm: resolved (fixed in 3.0.7.1-2) bullseye: resolved (fixed in 3.0.7.1-2) for

CVE-2019-14498 [HIGH] CVE-2019-14498: vlc - A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN... A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted CAF file. Scope: local bookworm: resolved (fixed in 3.0.8-1) bullseye: resolved (fixed in 3.0.8-1) forky: resolved (fixed in 3.0.8-1) sid: resolved (fixed in 3.0.8-1) trixie: resolved (fixed in 3.0.8-1)

CVE-2019-14776 [HIGH] CVE-2019-14776: vlc - A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoL... A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file. Scope: local bookworm: resolved (fixed in 3.0.8-1) bullseye: resolved (fixed in 3.0.8-1) forky: resolved (fixed in 3.0.8-1) sid: resolved (fixed in 3.0.8-1) trixie: resolved (fixed in 3.0.8-1)

CVE-2019-14533 [HIGH] CVE-2019-14533: vlc - The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has... The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free. Scope: local bookworm: resolved (fixed in 3.0.8-1) bullseye: resolved (fixed in 3.0.8-1) forky: resolved (fixed in 3.0.8-1) sid: resolved (fixed in 3.0.8-1) trixie: resolved (fixed in 3.0.8-1)

CVE-2013-1954 [MEDIUM] CVE-2013-1954: vlc - The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and... The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read. Scope: local bookworm: resolved (fixed in 2.0.6-1) bullseye: resolved (fixed in 2.0.6-1) forky: resolved (fixed in 2.0.6-1) s