Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

The version of VLC media player installed on the remote Windows host is prior to 2.0.8. It is, therefore, affected by multiple vulnerabilities:

  - An exploitable denial of service vulnerability exists in plugins/demux/libmkv_plugin.dll in VideoLAN VLC     Media Player 2.0.7 and possibly other versions. Allows remote attackers to cause a denial of service     (crash) and possibly execute arbitrary code via a crafted MKV file, possibly involving an integer     overflow and out-of-bounds read or heap-based buffer overflow, or an uncaught exception. (CVE-2013-3245).

  - An exploitable denial of service vulnerability exists in the mp4a packetizer     (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8. Allows remote attackers to     cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.     (CVE-2013-4388).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An exploitable denial of service vulnerability exists in VideoLAN VLC Media Player 2.0.8 and earlier. Allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a URL in a m3u file.

The remote host is running VLC 2.x prior to 2.0.9 and is affected by a buffer overflow vulnerability in 'packetizer/mpeg4audio.c'.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple buffer overflows have been found in the VideoLAN media player. Processing malformed subtitles or movie files could lead to denial of service and potentially the execution of arbitrary code.

ID	Name	Product	Family	Severity
138900	VLC < 2.0.8 Multiple Vulnerabilities	Nessus	Misc.	high
70560	VLC < 2.0.9 DoS	Nessus	Windows	high
8632	VLC Media Player < 2.0.9 Buffer Overflow	Nessus Network Monitor	Web Clients	medium
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
76417	Debian DSA-2973-1 : vlc - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-4388

critical

Tenable Plugins

high

high

medium

high

high