Summary
This host is installed with VLC media player and is prone to array indexing vulnerabilities.
Impact
Successful exploitation will allow the attackers to crash an affected application or compromise a vulnerable system by convincing a user to open a malicious media file or to visit a specially crafted web page.
Impact Level: Application.
Solution
Upgrade to VLC version 1.1.6 or apply patch from below link, For updates refer to http://www.videolan.org/vlc/
Insight
This issue is caused by an array indexing error in the 'Close()' and 'DemuxAudioMethod1()' [modules/demux/real.c] functions within the Real demuxer when processing a Real Media file with a zero 'i_subpackets' value.
Affected
VLC Media Player version 1.1.5 and prior.
References
Severity
Classification
-
CVE CVE-2010-3907 -
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Adobe Reader Multimeda Doc.media.newPlayer Code Execution Vulnerability (Linux)
- Adobe Shockwave Player 3D Model Buffer Overflow Vulnerabilities
- Citrix Provisioning Services SoapServer Buffer Overflow Vulnerability
- ChaSen Buffer Overflow Vulnerability (Linux)
- Adobe Reader 'Plug-in' Buffer Overflow Vulnerability (Linux)