The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.

The remote host is affected by the vulnerability described in GLSA-201603-08 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could possibly execute arbitrary code or cause Denial       of Service.
  Workaround :

    There is no known work around at this time.

The remote host is running VLC 2.x prior to 2.2.0 and is affected by multiple vulnerabilities :

 - A buffer overflow exists in the VLC Update utility when handling overly large status files. Specifically, this affects the 'GetUpdateFile()' function in the source file 'src/misc/update.c'. (CVE-2014-9625)
 - Multiple buffer overflow flaws exist in the mp4 demuxer due to improper parsing of string boxes. Specifically, these issues affect the 'MP4_ReadBox_name()' function in the source file 'modules/demux/libmp4.c'. (CVE-2014-9626, CVE-2014-9627, CVE-2014-9628)
 - A buffer overflow exists in the Schroedinger encoder due to a flaw when calling 'memcpy'. Specifically, this issue affects the 'Encode()' function in the source file 'modules/codec/schroedinger.c'. Note: This issue also affects the Dirac encoder, which has been removed from VLC in version 2.1.6. (CVE-2014-9629)
 - A heap-based buffer overflow flaw occurs due to invalid write access while streaming OGG files over RTP. Specifically, this affects the 'rtp_packetize_xiph_config()' function in the source file 'modules/stream_out/rtpfmt.c'. (CVE-2014-9630)
 - Overflow conditions exist in the Ogg, AVI, ASF, TTA, and MP4 demuxers that are triggered as user-supplied input is not properly validated. With a specially crafted media file, a context-dependent attacker can cause heap-based buffer overflows, potentially allowing the execution of arbitrary code.
 - An overflow condition exists in the 'Ogg_DecodePacket()' function in 'modules/demux/ogg.c'. The issue is triggered as user-supplied input is not properly validated when handling packet header size. This may allow a context-dependent attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - An overflow condition exists that is triggered as user-supplied input is not properly validated when handling a WAV file. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-3941)

Fabian Yamaguchi discovered multiple vulnerabilities in VLC, a multimedia player and streamer :

  - CVE-2014-9626     The MP4 demuxer, when parsing string boxes, did not     properly check the length of the box, leading to a     possible integer underflow when using this length value     in a call to memcpy(). This could allow remote attackers     to cause a denial of service (crash) or arbitrary code     execution via crafted MP4 files.

  - CVE-2014-9627     The MP4 demuxer, when parsing string boxes, did not     properly check that the conversion of the box length     from 64bit integer to 32bit integer on 32bit platforms     did not cause a truncation, leading to a possible buffer     overflow. This could allow remote attackers to cause a     denial of service (crash) or arbitrary code execution     via crafted MP4 files.

  - CVE-2014-9628     The MP4 demuxer, when parsing string boxes, did not     properly check the length of the box, leading to a     possible buffer overflow. This could allow remote     attackers to cause a denial of service (crash) or     arbitrary code execution via crafted MP4 files.

  - CVE-2014-9629     The Dirac and Schroedinger encoders did not properly     check for an integer overflow on 32bit platforms,     leading to a possible buffer overflow. This could allow     remote attackers to cause a denial of service (crash) or     arbitrary code execution.

ID	Name	Product	Family	Type	Severity
89901	GLSA-201603-08 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
9266	VLC Media Player < 2.2.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
81130	Debian DSA-3150-1 : vlc - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2014-9630

high

Tenable Plugins

critical

high

high