Out-of-bounds read in VLC Media Player - CVE-2017-8312

Vulnerability identifier: #VU6888

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear

CVE-ID: CVE-2017-8312

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vendor: VideoLAN

Affected software:
VLC Media Player

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to boundary error in ParseJSS in VideoLAN VLC, when processing subtitles. A remote unauthenticated attacker can create a specially crafted subtitle, trick the victim into loading it and trigger application crash via out-of-bounds read.

Update to version 2.2.5.1.

• http://blog.checkpoint.com/2017/05/23/hacked-in-translation/