SB2017062707 - Debian update for vlc

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017062707

SB2017062707 - Debian update for vlc

Published: June 27, 2017

Security Bulletin ID SB2017062707
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2017-8310)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear


The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to boundary error in CreateHtmlSubtitle in VideoLAN VLC, when processing subtitles. A remote unauthenticated attacker can create a specially crafted subtitle, trick the victim into loading it and trigger application crash via out-of-bounds read.

2) Heap-based buffer overflow (CVE-ID: CVE-2017-8311)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber


The vulnerability allows a remote unauthenticated attacker to execute arbitrary code and take over the device.

The weakness exists due to a boundary error in ParseJSS in VideoLAN VLC when processing subtitles. A remote attacker can create specially crafted subtitle file, which when loaded by the target user with the help of affected software leads to arbitrary code execution.

Successful exploitation of the vulnerability may result in full control over the affected PC.


3) Out-of-bounds read (CVE-ID: CVE-2017-8312)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear


The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to boundary error in ParseJSS in VideoLAN VLC, when processing subtitles. A remote unauthenticated attacker can create a specially crafted subtitle, trick the victim into loading it and trigger application crash via out-of-bounds read.

4) Out-of-bounds read (CVE-ID: CVE-2017-8313)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear


The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to boundary error in ParseJSS in VideoLAN VLC, when processing subtitles. A remote unauthenticated attacker can create a specially crafted subtitle, trick the victim into loading it and trigger application crash via out-of-bounds read.

Remediation

Install update from vendor's website.

References