Multiple integer overflows in real.c in the Real demuxer plugin in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a zero i_subpackets value in a Real Media file, leading to a heap-based buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of VLC media player installed on the remote host is earlier than 1.1.6.  Such versions are reportedly affected by the following vulnerabilities :

  - An integer overflow vulnerability exists due a failure     to properly parse the header of a Real Media, which     could then trigger a heap-based buffer overflow. It is     not yet known if this issue can be exploited to execute     arbitrary code. (CVE-2010-3907)

  - There are two heap corruption vulnerabilities in the     CDG decoder that arise because of a failure to validate     indices into statically-sized arrays on the heap, which     could allow for arbitrary code execution. (CVE-2011-0021)

  - The 'StripTags()' function in the USF and Text decoders     may scan past the end of a subtitle in an MKV file with     an opening '<' char but without a corresponding closing     '>' char, resulting in heap memory corruption.     (CVE-2011-0522)

The remote host contains VLC player, a multi-media application. 

Versions of VLC media player earlier than 1.1.6 are potentially affected by multiple vulnerabilities :

  - An integer overflow vulnerability exists due to a failure to properly parse the header of a Real Media, which could then trigger a heap-based buffer overflow.  It is not yet known if this issue can be exploited to execute arbitrary code. (CVE-2010-3907)

  - There are two heap corruption vulnerabilities in the CDG decoders that arise because of a failure to validate indices into statically-sized arrays on the heap, which could allow for arbitrary code execution. (CVE-2011-0021)

  - A heap-based memory corruption vulnerability exists i the StripTags function in the USF decoder. (CVE-20111-0522)

ID	Name	Product	Family	Type	Severity
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
51772	VLC Media Player < 1.1.6 Multiple Vulnerabilities	Nessus	Windows	Local	high
5746	VLC Media Player < 1.1.6 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients		high

Detections

Analytics

CVE-2010-3907

critical

Tenable Plugins

high

high

high