The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple buffer overflows have been found in the VideoLAN media player. Processing malformed subtitles or movie files could lead to denial of service and potentially the execution of arbitrary code.

The remote host is running VLC 2.x prior to 2.0.6 and is affected by a a buffer overflow vulnerability related to the ASF demuxer plugin.

The version of VLC media player installed on the remote host is earlier than 2.0.6.  It is, therefore, reportedly affected by a buffer overflow vulnerability related to the ASF demuxer plugin.

ID	Name	Product	Family	Severity
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
76417	Debian DSA-2973-1 : vlc - security update	Nessus	Debian Local Security Checks	high
6778	VLC Media Player < 2.0.6 ASF Demuxer Buffer Overflow	Nessus Network Monitor	Web Clients	high
66216	VLC < 2.0.6 ASF Demuxer Buffer Overflow	Nessus	Windows	medium

Detections

Analytics

CVE-2013-1954

high

Tenable Plugins

high

high

high

medium