The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.

The remote host is affected by the vulnerability described in GLSA-201603-08 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could possibly execute arbitrary code or cause Denial       of Service.
  Workaround :

    There is no known work around at this time.

The remote host is running VLC 2.x prior to 2.2.0 and is affected by multiple vulnerabilities :

 - A buffer overflow exists in the VLC Update utility when handling overly large status files. Specifically, this affects the 'GetUpdateFile()' function in the source file 'src/misc/update.c'. (CVE-2014-9625)
 - Multiple buffer overflow flaws exist in the mp4 demuxer due to improper parsing of string boxes. Specifically, these issues affect the 'MP4_ReadBox_name()' function in the source file 'modules/demux/libmp4.c'. (CVE-2014-9626, CVE-2014-9627, CVE-2014-9628)
 - A buffer overflow exists in the Schroedinger encoder due to a flaw when calling 'memcpy'. Specifically, this issue affects the 'Encode()' function in the source file 'modules/codec/schroedinger.c'. Note: This issue also affects the Dirac encoder, which has been removed from VLC in version 2.1.6. (CVE-2014-9629)
 - A heap-based buffer overflow flaw occurs due to invalid write access while streaming OGG files over RTP. Specifically, this affects the 'rtp_packetize_xiph_config()' function in the source file 'modules/stream_out/rtpfmt.c'. (CVE-2014-9630)
 - Overflow conditions exist in the Ogg, AVI, ASF, TTA, and MP4 demuxers that are triggered as user-supplied input is not properly validated. With a specially crafted media file, a context-dependent attacker can cause heap-based buffer overflows, potentially allowing the execution of arbitrary code.
 - An overflow condition exists in the 'Ogg_DecodePacket()' function in 'modules/demux/ogg.c'. The issue is triggered as user-supplied input is not properly validated when handling packet header size. This may allow a context-dependent attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - An overflow condition exists that is triggered as user-supplied input is not properly validated when handling a WAV file. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-3941)

vlc was updated to the current openSUSE Tumbleweed version.

live555 was also updated to the current openSUSE Tumbleweed version as a dependency.

Security issues fixed :

  - Fix various buffer overflows and null ptr dereferencing     (boo#914268, CVE-2014-9625).

Other fixes :

  - Enable SSE2 instruction set for x86_64

  - Disable fluidsynth again: the crashes we had earlier are     still not all fixed. They are less, but less common     makes it more difficult to debug.

On openSUSE 13.1 :

  - Update to version 2.1.5 :

  + Core: Fix compilation on OS/2.

  + Access: Stability improvements for the QTSound capture     module.

  + Mac OS X audio output :

  - Fix channel ordering.

  - Increase the buffersize.

  + Decoders :

  - Fix DxVA2 decoding of samples needing more surfaces.

  - Improve MAD resistance to broken mp3 streams.

  - Fix PGS alignment in MKV.

  + Qt Interface: Don't rename mp3 converted files to .raw.

  + Mac OS X Interface :

  - Correctly support video-on-top.

  - Fix video output event propagation on Macs with retina     displays.

  - Stability improvements when using future VLC releases     side by side.

  + Streaming: Fix transcode when audio format changes.

  + Updated translations.

  - Update to version 2.1.4 :

  + Demuxers: Fix issue in WMV with multiple compressed     payload and empty payloads.

  + Video Output: Fix subtitles size rendering on Windows.

  + Mac OS X :

  - Fix DVD playback regression.

  - Fix misleading error message during video playback on OS     X 10.9.

  - Fix hardware acceleration memleaks.

ID	Name	Product	Family	Type	Severity
89901	GLSA-201603-08 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
9266	VLC Media Player < 2.2.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
81199	openSUSE Security Update : vlc (openSUSE-SU-2015:0201-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2014-9625

high

Tenable Plugins

critical

high

high