Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.

The version of VLC media player installed on the remote host with version prior to 2.2.4, is affected by a denial of service vulnerability. A buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.

The remote host is affected by the vulnerability described in GLSA-201701-39 (VLC: Buffer overflow)

    A buffer overflow was discovered in the DecodeAdpcmImaQT function in       modules/codec/adpcm.c in the VideoLAN VLC media player.
  Impact :

    Remote attackers, by enticing a user to execute a specially crafted       QuickTime IMA file, could cause a Denial of Service condition or possibly       execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is running VLC 2.x prior to 2.2.4 and is affected by an out-of-bounds write flaw in the 'DecodeAdpcmImaQT()' function in 'modules/codec/adpcm.c' that is triggered when handling a specially crafted media file. This may allow a context-dependent attacker to potentially execute arbitrary code.

This update for vlc to version 2.1.6 fixes the following issues :

These CVE were fixed :

  - CVE-2016-5108: Reject invalid QuickTime IMA files     (boo#984382).

  - CVE-2016-3941: Heap overflow in processing wav files     (boo#973354).

These security issues without were fixed :

  - Fix heap overflow in decomp stream filter.

  - Fix buffer overflow in updater.

  - Fix potential buffer overflow in schroedinger encoder.

  - Fix NULL pointer dereference in DMO decoder.

  - Fix buffer overflow in parsing of string boxes in mp4     demuxer.

  - Fix SRTP integer overflow.

  - Fix potential crash in zip access.

  - Fix read overflow in Ogg demuxer.

This update for vlc to 2.2.4 to fix the following security issue :

  - CVE-2016-5108: Fix out-of-bound write in adpcm QT IMA     codec (boo#984382).

This also include an update of codecs and libraries to fix these 3rd party security issues :

  - CVE-2016-1514: Matroska libebml EbmlUnicodeString Heap     Information Leak

  - CVE-2016-1515: Matroska libebml Multiple ElementList     Double Free Vulnerabilities

  - CVE-2015-7981: The png_convert_to_rfc1123 function in     png.c in libpng allowed remote attackers to obtain     sensitive process memory information via crafted tIME     chunk data in an image file, which triggers an     out-of-bounds read (bsc#952051).

  - CVE-2015-8126: Multiple buffer overflows in the (1)     png_set_PLTE and (2) png_get_PLTE functions in libpng     allowed remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a small bit-depth value in an IHDR (aka image     header) chunk in a PNG image (bsc#954980).

The VLC project reports :

Fix out-of-bound write in adpcm QT IMA codec (CVE-2016-5108)

Patrick Coleman discovered that missing input sanitising in the ADPCM decoder of the VLC media player may result in the execution of arbitrary code if a malformed media file is opened.

ID	Name	Product	Family	Severity
138343	VLC < 2.2.4 DoS	Nessus	Misc.	critical
96543	GLSA-201701-39 : VLC: Buffer overflow	Nessus	Gentoo Local Security Checks	critical
9799	VLC Media Player 2.x < 2.2.4 RCE	Nessus Network Monitor	Web Clients	critical
91773	openSUSE Security Update : vlc (openSUSE-2016-755)	Nessus	SuSE Local Security Checks	critical
91772	openSUSE Security Update : vlc (openSUSE-2016-754)	Nessus	SuSE Local Security Checks	critical
91581	FreeBSD : VLC -- Possibly remote code execution via crafted file (6d402857-2fba-11e6-9f31-5404a68ad561)	Nessus	FreeBSD Local Security Checks	critical
91524	Debian DSA-3598-1 : vlc - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-5108

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical