Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.

The remote host is affected by the vulnerability described in GLSA-200812-24 (VLC: Multiple vulnerabilities)

    Tobias Klein reported the following vulnerabilities:
    A     stack-based buffer overflow when processing CUE image files in     modules/access/vcd/cdrom.c (CVE-2008-5032).
    A stack-based     buffer overflow when processing RealText (.rt) subtitle files in the     ParseRealText() function in modules/demux/subtitle.c     (CVE-2008-5036).
    An integer overflow when processing RealMedia     (.rm) files in the ReadRealIndex() function in real.c in the Real     demuxer plugin, leading to a heap-based buffer overflow     (CVE-2008-5276).
  Impact :

    A remote attacker could entice a user to open a specially crafted CUE     image file, RealMedia file or RealText subtitle file, possibly     resulting in the execution of arbitrary code with the privileges of the     user running the application.
  Workaround :

    There is no known workaround at this time.

A version of VLC between 0.5.0 and 0.9.5 is installed on the remote host.  Such versions are affected by the following vulnerabilities : 

  - RealText subtitle file (modules\demux\subtitle.c) processing is susceptible to a buffer overflow caused by user-supplied data from a malicious subtitle file being copied into static buffers without proper validation.
  - CUE image file (modules\access\vcd\cdrom.c) processing is susceptible to a stack-based buffer overflow because data supplied by the CUE file is supplied as an array index without proper validation.

An attacker may be able to leverage these issues to execute arbitrary code on the remote host by tricking a user into opening a specially crafted video file using the affected application.

A version of VLC between 0.5.0 and 0.9.5 is installed on the remote host.  Such versions are affected by the following vulnerabilities :

  - RealText subtitle file (modules\demux\subtitle.c)     processing is susceptible to a buffer overflow caused     by user-supplied data from a malicious subtitle file     being copied into static buffers without proper     validation.

  - CUE image file (modules\access\vcd\cdrom.c)     processing is susceptible to a stack-based buffer     overflow because data supplied by the CUE file is     supplied as an array index without proper validation.

An attacker may be able to leverage these issues to execute arbitrary code on the remote host by tricking a user into opening a specially crafted video file using the affected application.

The VLC Team reports :

The VLC media player contains a stack overflow vulnerability while parsing malformed cue files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of VLC media player.

ID	Name	Product	Family	Type	Severity
35271	GLSA-200812-24 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
4747	VLC Media Player 0.5.0 to 0.9.5 Stack-Based Buffer Overflows	Nessus Network Monitor	Web Clients		medium
34730	VLC Media Player 0.5.0 to 0.9.5 Stack-Based Buffer Overflows	Nessus	Windows	Local	high
34723	FreeBSD : vlc -- cue processing stack overflow (4b09378e-addb-11dd-a578-0030843d3802)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2008-5036

high

Tenable Plugins

high

medium

high

high