media-video/vlc-3.0.9999 — Security Advisories

▸ GLSA 202409-17 VLC: Multiple Vulnerabilities this version unaffected normal remote 2024-09-22

Multiple vulnerabilities have been discovered in VLC, the worst of which could result in arbitrary code execution.

Announced: 2024-09-22
Revised: 2024-09-22
Access: remote
Bugs: #788226 #883943 #917274
Advisory: https://security.gentoo.org/glsa/202409-17

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 3.0.20	>= 3.0.20

Background

VLC is a cross-platform media player and streaming server.

Description

Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.20"

References

CVE-2022-41325

▸ GLSA 202101-37 VLC: Buffer overflow this version unaffected normal remote 2021-01-29

A buffer overflow in VLC might allow remote attacker(s) to execute arbitrary code.

Announced: 2021-01-29
Revised: 2021-01-29
Access: remote
Bugs: #765040
Advisory: https://security.gentoo.org/glsa/202101-37

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 3.0.12.1	>= 3.0.12.1

Background

VLC is a cross-platform media player and streaming server.

Description

VLC was found to have a buffer overflow when handling crafted MKV files.

Impact

A remote attacker could entice a user to open a specially crafted MKV file using VLC possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.12.1"

References

CVE-2020-26664

▸ GLSA 202005-11 VLC: Buffer overflow this version unaffected normal local, remote 2020-05-14

A buffer overflow in VLC might allow local or remote attacker(s) to execute arbitrary code.

Announced: 2020-05-14
Revised: 2020-05-14
Access: local, remote
Bugs: #721940
Advisory: https://security.gentoo.org/glsa/202005-11

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 3.0.10	>= 3.0.10

Background

VLC is a cross-platform media player and streaming server.

Description

A buffer overflow in DecodeBlock in sdl_image.c was discovered.

Impact

A remote user could craft a specifically crafted image file that could execute arbitrary code or cause denial of service.

Workaround

The user should refrain from opening files from untrusted third parties or accessing untrusted remote sites (or disable the VLC browser plugins), until they upgrade.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.10"

References

▸ GLSA 201909-02 VLC: Multiple vulnerabilities this version unaffected normal remote 2019-09-06

Multiple vulnerabilities have been found in VLC, the worst of which could result in the arbitrary execution of code.

Announced: 2019-09-06
Revised: 2019-09-06
Access: remote
Bugs: #689974
Advisory: https://security.gentoo.org/glsa/201909-02

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 3.0.8	>= 3.0.8

Background

VLC is a cross-platform media player and streaming server.

Description

Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.8"

References

▸ GLSA 201908-23 VLC: Multiple vulnerabilities this version unaffected normal local, remote 2019-08-18

Multiple vulnerabilities have been found in VLC, the worst of which could result in the arbitrary execution of code.

Announced: 2019-08-18
Revised: 2019-08-18
Access: local, remote
Bugs: #688642
Advisory: https://security.gentoo.org/glsa/201908-23

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 3.0.7	>= 3.0.7

Background

VLC is a cross-platform media player and streaming server.

Description

Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details.

Impact

Remote attackers, by enticing a user to execute a specially crafted media file, could cause a Denial of Service condition or possibly execute arbitrary code.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-3.0.7"

References

▸ GLSA 201707-10 VLC: Multiple vulnerabilities this version unaffected normal remote 2017-07-08

Multiple vulnerabilities have been found in VLC, the worst of which may allow remote attackers to execute arbitrary code.

Announced: 2017-07-08
Revised: 2017-07-08
Access: remote
Bugs: #619494
Advisory: https://security.gentoo.org/glsa/201707-10

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 2.2.6	>= 2.2.6

Background

VLC is a cross-platform media player and streaming server.

Description

Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker, by enticing a user to open a specially crafted subtitles file, could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-2.2.6"

References

▸ GLSA 201701-39 VLC: Buffer overflow this version unaffected normal remote 2017-01-17

A buffer overflow in VLC might allow remote attackers to execute arbitrary code.

Announced: 2017-01-17
Revised: 2017-01-17
Access: remote
Bugs: #584510
Advisory: https://security.gentoo.org/glsa/201701-39

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 2.2.4	>= 2.2.4

Background

VLC is a cross-platform media player and streaming server.

Description

A buffer overflow was discovered in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in the VideoLAN VLC media player.

Impact

Remote attackers, by enticing a user to execute a specially crafted QuickTime IMA file, could cause a Denial of Service condition or possibly execute arbitrary code.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-2.2.4"

References

CVE-2016-5108

▸ GLSA 201603-08 VLC: Multiple vulnerabilities this version unaffected normal remote 2016-03-12

Multiple vulnerabilities have been found in VLC allowing remote attackers to execute arbitrary code or cause Denial of Service.

Announced: 2016-03-12
Revised: 2016-03-12
Access: remote
Bugs: #534532 #537154 #542222 #558418
Advisory: https://security.gentoo.org/glsa/201603-08

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 2.2.1-r1	>= 2.2.1-r1

Background

VLC is a cross-platform media player and streaming server.

Description

Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details.

Impact

Remote attackers could possibly execute arbitrary code or cause Denial of Service.

Workaround

There is no known work around at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-2.2.1-r1"

References

▸ GLSA 201411-01 VLC: Multiple vulnerabilities this version unaffected normal remote 2014-11-05

Multiple vulnerabilities have been found in VLC, the worst of which could lead to user-assisted execution of arbitrary code.

Announced: 2014-11-05
Revised: 2014-11-05
Access: remote
Bugs: #279340 #285370 #316709 #332361 #350933 #352206 #352776 #353326 #360189 #363359 #370321 #375167 #385953 #395543 #408881 #414409 #424435 #442758 #450438 #454650 #476436 #486902 #493710 #499806
Advisory: https://security.gentoo.org/glsa/201411-01

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 2.1.2	>= 2.1.2

Background

VLC is a cross-platform media player and streaming server.

Description

Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user to open a specially crafted media file using VLC, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-2.1.2"

References

▸ GLSA 200812-24 VLC: Multiple vulnerabilities this version unaffected normal remote 2008-12-24

Multiple vulnerabilities in VLC may lead to the remote execution of arbitrary code.

Announced: 2008-12-24
Revised: 2008-12-24
Access: remote
Bugs: #245774 #249391
Advisory: https://security.gentoo.org/glsa/200812-24

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 0.9.8a	>= 0.9.8a

Background

VLC is a cross-platform media player and streaming server.

Description

Tobias Klein reported the following vulnerabilities:

A stack-based buffer overflow when processing CUE image files in modules/access/vcd/cdrom.c (CVE-2008-5032).
A stack-based buffer overflow when processing RealText (.rt) subtitle files in the ParseRealText() function in modules/demux/subtitle.c (CVE-2008-5036).
An integer overflow when processing RealMedia (.rm) files in the ReadRealIndex() function in real.c in the Real demuxer plugin, leading to a heap-based buffer overflow (CVE-2008-5276).

Impact

A remote attacker could entice a user to open a specially crafted CUE image file, RealMedia file or RealText subtitle file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-0.9.8a"

References

▸ GLSA 200809-06 VLC: Multiple vulnerabilities this version unaffected normal remote 2008-09-07

Two vulnerabilities in VLC may lead to the remote execution of arbitrary code.

Announced: 2008-09-07
Revised: 2008-09-07
Access: remote
Bugs: #235238 #235589
Advisory: https://security.gentoo.org/glsa/200809-06

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 0.8.6i-r2	>= 0.8.6i-r2

Background

VLC is a cross-platform media player and streaming server.

Description

g_ reported the following vulnerabilities:

An integer overflow leading to a heap-based buffer overflow in the Open() function in modules/demux/tta.c (CVE-2008-3732).
A signedness error leading to a stack-based buffer overflow in the mms_ReceiveCommand() function in modules/access/mms/mmstu.c (CVE-2008-3794).

Impact

A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6i-r2"

References

▸ GLSA 200807-13 VLC: Multiple vulnerabilities this version unaffected normal local, remote 2008-07-31

Multiple vulnerabilities in VLC may allow for the execution of arbitrary code.

Announced: 2008-07-31
Revised: 2008-07-31
Access: local, remote
Bugs: #221959 #230692
Advisory: https://security.gentoo.org/glsa/200807-13

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 0.8.6i	>= 0.8.6i

Background

VLC is a cross-platform media player and streaming server.

Description

Remi Denis-Courmont reported that VLC loads plugins from the current working directory in an unsafe manner (CVE-2008-2147).
Alin Rad Pop (Secunia Research) reported an integer overflow error in the Open() function in the file modules/demux/wav.c (CVE-2008-2430).

Impact

A remote attacker could entice a user to open a specially crafted .wav file, and a local attacker could entice a user to run VLC from a directory containing specially crafted modules, possibly resulting in the execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6i"

References

▸ GLSA 200804-25 VLC: User-assisted execution of arbitrary code this version unaffected normal remote 2008-04-23

Multiple vulnerabilities were found in VLC, allowing for the execution of arbitrary code.

Announced: 2008-04-23
Revised: 2008-04-23
Access: remote
Bugs: #214277 #214627
Advisory: https://security.gentoo.org/glsa/200804-25

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 0.8.6f	>= 0.8.6f

Background

VLC is a cross-platform media player and streaming server.

Description

Multiple vulnerabilities were found in VLC:

Luigi Auriemma discovered that the stack-based buffer overflow when reading subtitles, which has been reported as CVE-2007-6681 in GLSA 200803-13, was not properly fixed (CVE-2008-1881).
Alin Rad Pop of Secunia reported an array indexing vulnerability in the sdpplin_parse() function when processing streams from RTSP servers in Xine code, which is also used in VLC (CVE-2008-0073).
Drew Yao and Nico Golde reported an integer overflow in the MP4_ReadBox_rdrf() function in the file libmp4.c leading to a heap-based buffer overflow when reading MP4 files (CVE-2008-1489).
Drew Yao also reported integer overflows in the MP4 demuxer, the Real demuxer and in the Cinepak codec, which might lead to buffer overflows (CVE-2008-1768).
Drew Yao finally discovered and a boundary error in Cinepak, which might lead to memory corruption (CVE-2008-1769).

Impact

A remote attacker could entice a user to open a specially crafted media file or stream, possibly resulting in the remote execution of arbitrary code.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6f"

References

▸ GLSA 200803-13 VLC: Multiple vulnerabilities this version unaffected high remote 2008-03-07

Multiple vulnerabilities were found in VLC, allowing for the execution of arbitrary code and Denial of Service.

Announced: 2008-03-07
Revised: 2008-03-07
Access: remote
Bugs: #203345 #211575 #205299
Advisory: https://security.gentoo.org/glsa/200803-13

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 0.8.6e	>= 0.8.6e

Background

VLC is a cross-platform media player and streaming server.

Description

Multiple vulnerabilities were found in VLC:

Michal Luczaj and Luigi Auriemma reported that VLC contains boundary errors when handling subtitles in the ParseMicroDvd(), ParseSSA(), and ParseVplayer() functions in the modules/demux/subtitle.c file, allowing for a stack-based buffer overflow (CVE-2007-6681).
The web interface listening on port 8080/tcp contains a format string error in the httpd_FileCallBack() function in the network/httpd.c file (CVE-2007-6682).
The browser plugin possibly contains an argument injection vulnerability (CVE-2007-6683).
The RSTP module triggers a NULL pointer dereference when processing a request without a "Transport" parameter (CVE-2007-6684).
Luigi Auriemma and Remi Denis-Courmont found a boundary error in the modules/access/rtsp/real_sdpplin.c file when processing SDP data for RTSP sessions (CVE-2008-0295) and a vulnerability in the libaccess_realrtsp plugin (CVE-2008-0296), possibly resulting in a heap-based buffer overflow.
Felipe Manzano and Anibal Sacco (Core Security Technologies) discovered an arbitrary memory overwrite vulnerability in VLC's MPEG-4 file format parser (CVE-2008-0984).

Impact

A remote attacker could send a long subtitle in a file that a user is enticed to open, a specially crafted MP4 input file, long SDP data, or a specially crafted HTTP request with a "Connection" header value containing format specifiers, possibly resulting in the remote execution of arbitrary code. Also, a Denial of Service could be caused and arbitrary files could be overwritten via the "demuxdump-file" option in a filename in a playlist or via an EXTVLCOPT statement in an MP3 file.

Workaround

There is no known workaround at this time.

Resolution

All VLC users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6e"

References

▸ GLSA 200707-12 VLC media player: Format string vulnerabilities this version unaffected normal remote 2007-07-28

A vulnerability has been discovered in VLC media player, allowing for the remote execution of arbitrary code.

Announced: 2007-07-28
Revised: 2007-07-28
Access: remote
Bugs: #182389
Advisory: https://security.gentoo.org/glsa/200707-12

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 0.8.6c	>= 0.8.6c

Background

VLC media player is a multimedia player for various audio and video formats.

Description

David Thiel from iSEC Partners Inc. discovered format string errors in various plugins when parsing data. The affected plugins include Vorbis, Theora, CDDA and SAP.

Impact

A remote attacker could entice a user to open a specially crafted media file, possibly resulting in the execution of arbitrary code with the privileges of the user running VLC media player.

Workaround

There is no known workaround at this time.

Resolution

All VLC media player users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6c"

References

CVE-2007-3316

▸ GLSA 200701-24 VLC media player: Format string vulnerability this version unaffected normal remote 2007-01-26

VLC media player improperly handles format strings, allowing for the execution of arbitrary code.

Announced: 2007-01-26
Revised: 2007-01-26
Access: remote
Bugs: #159845
Advisory: https://security.gentoo.org/glsa/200701-24

Affected packages

Package	Arch	Vulnerable	Unaffected
media-video/vlc	*	< 0.8.6-r1	>= 0.8.6-r1

Background

VLC media player is a multimedia player for various audio and video formats.

Description

Kevin Finisterre has discovered that when handling media locations, various functions throughout VLC media player make improper use of format strings.

Impact

An attacker could entice a user to open a specially crafted media location or M3U file with VLC media player, and execute arbitrary code on the system with the rights of the user running VLC media player.

Workaround

There is no known workaround at this time.

Resolution

All VLC media player users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6-r1"

References

CVE-2007-0017