Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cause a denial of service (crash) via a crafted wav file, related to "seek across EOF."

The version of VLC media player installed on the remote Windows host is prior to 2.2.0. It is, therefore, affected by multiple vulnerabilities:

  - An exploitable Cross-site scripting (XSS) vulnerability exists in the httpd_HtmlError function in     network/httpd.c in the web interface in VideoLAN VLC Media Player before 2.2.0 allows remote attackers to     inject arbitrary web script or HTML via the path info. (CVE-2014-9743).

  - An exploitable denial of service vulnerability exists in the AStreamPeekStream function in input/stream.c     in VideoLAN VLC media player before 2.2.0. Allows remote attackers to cause a denial of service (crash)     via a crafted wav file, related to seek across EOF. (CVE-2016-3941).

The remote host is running VLC 2.x prior to 2.2.1 and is affected by multiple vulnerabilities :

 - A flaw exists that is triggered as user-supplied input is not properly validated when handling a specially crafted MP4 file. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists that is triggered as user-supplied input is not properly validated when handling a WAV file. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.

This update for vlc to version 2.1.6 fixes the following issues :

These CVE were fixed :

  - CVE-2016-5108: Reject invalid QuickTime IMA files     (boo#984382).

  - CVE-2016-3941: Heap overflow in processing wav files     (boo#973354).

These security issues without were fixed :

  - Fix heap overflow in decomp stream filter.

  - Fix buffer overflow in updater.

  - Fix potential buffer overflow in schroedinger encoder.

  - Fix NULL pointer dereference in DMO decoder.

  - Fix buffer overflow in parsing of string boxes in mp4     demuxer.

  - Fix SRTP integer overflow.

  - Fix potential crash in zip access.

  - Fix read overflow in Ogg demuxer.

The remote host is running VLC 2.x prior to 2.2.0 and is affected by multiple vulnerabilities :

 - A buffer overflow exists in the VLC Update utility when handling overly large status files. Specifically, this affects the 'GetUpdateFile()' function in the source file 'src/misc/update.c'. (CVE-2014-9625)
 - Multiple buffer overflow flaws exist in the mp4 demuxer due to improper parsing of string boxes. Specifically, these issues affect the 'MP4_ReadBox_name()' function in the source file 'modules/demux/libmp4.c'. (CVE-2014-9626, CVE-2014-9627, CVE-2014-9628)
 - A buffer overflow exists in the Schroedinger encoder due to a flaw when calling 'memcpy'. Specifically, this issue affects the 'Encode()' function in the source file 'modules/codec/schroedinger.c'. Note: This issue also affects the Dirac encoder, which has been removed from VLC in version 2.1.6. (CVE-2014-9629)
 - A heap-based buffer overflow flaw occurs due to invalid write access while streaming OGG files over RTP. Specifically, this affects the 'rtp_packetize_xiph_config()' function in the source file 'modules/stream_out/rtpfmt.c'. (CVE-2014-9630)
 - Overflow conditions exist in the Ogg, AVI, ASF, TTA, and MP4 demuxers that are triggered as user-supplied input is not properly validated. With a specially crafted media file, a context-dependent attacker can cause heap-based buffer overflows, potentially allowing the execution of arbitrary code.
 - An overflow condition exists in the 'Ogg_DecodePacket()' function in 'modules/demux/ogg.c'. The issue is triggered as user-supplied input is not properly validated when handling packet header size. This may allow a context-dependent attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - An overflow condition exists that is triggered as user-supplied input is not properly validated when handling a WAV file. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-3941)

ID	Name	Product	Family	Type	Severity
138342	VLC < 2.2.0 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
9798	VLC Media Player 2.x < 2.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		critical
91773	openSUSE Security Update : vlc (openSUSE-2016-755)	Nessus	SuSE Local Security Checks	Local	critical
9266	VLC Media Player < 2.2.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high

Detections

Analytics

CVE-2016-3941

medium

Tenable Plugins

medium

critical

critical

high