VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service.

The remote host is affected by the vulnerability described in GLSA-201603-08 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could possibly execute arbitrary code or cause Denial       of Service.
  Workaround :

    There is no known work around at this time.

The remote host is running VLC 2.x prior to 2.1.5 and is affected by multiple vulnerabilities :

 - An error exists in the 'png_push_read_chunk()' function within the file 'pngpread.c' from the included libpng library that can allow denial of service attacks. (CVE-2014-0333)
 - A buffer overflow error exists in the 'read_server_hello()' function within the file 'lib/gnutls_handshake.c' from the included GnuTLS library that can allow arbitrary code execution or denial of service. (CVE-2014-3466)
 - A heap-based buffer overflow error exists in the transcode module due to improper validation of user-supplied input when handling invalid channel counts. An attacker can exploit this to execute arbitrary code. (CVE-2014-6440)

The version of VLC media player installed on the remote host is prior to 2.1.5. It is, therefore, affected by the following vulnerabilities :

  - An error exists in the png_push_read_chunk() function     within the file 'pngpread.c' from the included libpng     library that can allow denial of service attacks.
    (CVE-2014-0333)

  - A buffer overflow error exists in the     read_server_hello() function within the file     'lib/gnutls_handshake.c' from the included GnuTLS     library that can allow arbitrary code execution or     denial of service. (CVE-2014-3466)

  - A heap-based buffer overflow error exists in the     transcode module due to improper validation of     user-supplied input when handling invalid channel     counts. An attacker can exploit this to execute     arbitrary code. (CVE-2014-6440)

ID	Name	Product	Family	Type	Severity
89901	GLSA-201603-08 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
9265	VLC Media Player < 2.1.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		medium
78626	VLC Media Player < 2.1.5 Multiple Vulnerabilities	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2014-6440

critical

Tenable Plugins

critical

medium

critical