Vulnerability in VLC - Integer Underflow and Buffer Overflow
Summary
DSA-3150-1: vlc - security update. Affects vlc versions < 2.0.3-5+deb7u2. Fixed in 2.0.3-5+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
VLC is a popular multimedia player and streamer that allows users to play various audio and video formats. It is widely used across different platforms and provides a range of features for media playback. However, several vulnerabilities have been discovered in VLC that could potentially lead to a denial of service (crash) or arbitrary code execution.
Vulnerability Detail
The vulnerabilities in VLC are as follows:
-
CVE-2014-9626: The MP4 demuxer in VLC did not properly check the length of string boxes, leading to a possible integer underflow when using this length value in a call to memcpy(). This could allow remote attackers to cause a denial of service or arbitrary code execution via crafted MP4 files.
-
CVE-2014-9627: The MP4 demuxer in VLC did not properly check the conversion of the box length from a 64-bit integer to a 32-bit integer on 32-bit platforms, potentially causing a truncation and leading to a buffer overflow. This could allow remote attackers to cause a denial of service or arbitrary code execution via crafted MP4 files.
-
CVE-2014-9628: The MP4 demuxer in VLC did not properly check the length of string boxes, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service or arbitrary code execution via crafted MP4 files.
-
CVE-2014-9629: The Dirac and Schroedinger encoders in VLC did not properly check for an integer overflow on 32-bit platforms, potentially leading to a buffer overflow. This could allow remote attackers to cause a denial of service or arbitrary code execution.
How To Fix
Minimum fixed version
2.0.3-5+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vlcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
VLC is susceptible to multiple vulnerabilities, including integer underflow and buffer overflow issues. To mitigate these risks, it is crucial to update your VLC packages to the recommended versions. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vlc →
FAQ
VLC is a multimedia player and streamer that supports various audio and video formats.
The vulnerabilities in VLC include integer underflow and buffer overflow issues in the MP4 demuxer and the Dirac and Schroedinger encoders.
These vulnerabilities can be exploited by remote attackers through crafted MP4 files, potentially leading to a denial of service or arbitrary code execution.
No specific workarounds have been mentioned for these vulnerabilities.
To fix these vulnerabilities, it is recommended to upgrade your VLC packages to the latest available versions.
Related vulnerabilities
Recent vulnerabilities recorded for vlc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
