Videolan Vlc Media Player vulnerabilities

CVE-2010-3907 [CRITICAL] CWE-189 CVE-2010-3907: Multiple integer overflows in real.c in the Real demuxer plugin in VideoLAN VLC Media Player before Multiple integer overflows in real.c in the Real demuxer plugin in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a zero i_subpackets value in a Real Media file, leading to a heap-based buffer overflow.

CVE-2010-3124 [CRITICAL] CVE-2010-3124: Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows loc Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.

CVE-2010-2937 [MEDIUM] CWE-20 CVE-2010-2937: The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly process ID3v2 tags, which allows remote attackers to cause a denial of service (application crash) via a crafted media file.

CVE-2010-0364 [CRITICAL] CWE-119 CVE-2010-0364: Stack-based buffer overflow in VideoLAN VLC Media Player 0.8.6 allows user-assisted remote attackers Stack-based buffer overflow in VideoLAN VLC Media Player 0.8.6 allows user-assisted remote attackers to execute arbitrary code via an ogg file with a crafted Advanced SubStation Alpha Subtitle (.ass) file, probably involving the Dialogue field.

CVE-2009-2484 [CRITICAL] CWE-119 CVE-2009-2484: Stack-based buffer overflow in the Win32AddConnection function in modules/access/smb.c in VideoLAN V Stack-based buffer overflow in the Win32AddConnection function in modules/access/smb.c in VideoLAN VLC media player 0.9.9, when running on Microsoft Windows, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long smb URI in a playlist file.

CVE-2009-1045 [MEDIUM] CWE-20 CVE-2009-1045: requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consum requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via a long input argument in an in_play action.

CVE-2008-5276 [CRITICAL] CWE-189 CVE-2008-5276: Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.

CVE-2008-5032 [CRITICAL] CWE-119 CVE-2008-5032: Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assist Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. NOTE: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier,

CVE-2008-5036 [CRITICAL] CVE-2008-5036: Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assiste Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.

CVE-2008-4654 [CRITICAL] CWE-119 CVE-2008-4654: Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.

CVE-2008-4686 [CRITICAL] CVE-2008-4686: Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC med Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.

CVE-2008-4558 [MEDIUM] CWE-399 CVE-2008-4558: Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory an Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a signed comparison.

CVE-2008-3794 [MEDIUM] CWE-189 CVE-2008-3794: Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Med Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers to execute arbitrary code via a crafted mmst link with a negative size value, which bypasses a size check and triggers an integer overflow followed by a heap-based buffer overflow.

CVE-2008-3732 [CRITICAL] CWE-189 CVE-2008-3732: Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remot Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TTA file, which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

CVE-2008-2430 [CRITICAL] CWE-189 CVE-2008-2430: Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows a Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.

CVE-2008-2147 [MEDIUM] CVE-2008-2147: Untrusted search path vulnerability in VideoLAN VLC before 0 Untrusted search path vulnerability in VideoLAN VLC before 0.9.0 allows local users to execute arbitrary code via a malicious library under the modules/ or plugins/ subdirectories of the current working directory.

CVE-2008-1769 [MEDIUM] CVE-2008-1769: VLC before 0 VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers an out-of-bounds array access and memory corruption.

CVE-2008-1768 [MEDIUM] CVE-2008-1768: Multiple integer overflows in VLC before 0 Multiple integer overflows in VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via the (1) MP4 demuxer, (2) Real demuxer, and (3) Cinepak codec, which triggers a buffer overflow.

CVE-2008-1881 [HIGH] CVE-2008-1881: Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary code via a long subtitle in an SSA file. NOTE: this issue is due to an incomplete fix for CVE-2007-6681.

CVE-2008-1489 [CRITICAL] CVE-2008-1489: Integer overflow in the MP4_ReadBox_rdrf function in libmp4 Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box that triggers a heap-based buffer overflow, a different vulnerability than CVE-2008-0984.