VLC Media Player 'MP4' Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	47293
Class:	Boundary Condition Error
CVE:	CVE-2011-1684
Remote:	Yes
Local:	No
Published:	Apr 11 2011 12:00AM
Updated:	Nov 10 2014 12:57AM
Credit:	Aliz Hammond
Vulnerable:	VideoLAN VLC media player 1.1.8 Pardus Linux 2011 0 Pardus Linux 2009 0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	VideoLAN VLC media player 1.1.9

VLC Media Player 'MP4' Heap Based Buffer Overflow Vulnerability

The VLC Media Player is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.

An attacker could exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

VLC Media Player versions 1.0.0 through 1.1.8 are vulnerable.

VLC Media Player 'MP4' Heap Based Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

VLC Media Player 'MP4' Heap Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

VLC Media Player 'MP4' Heap Based Buffer Overflow Vulnerability

References:

• MP4: fix heap-based buffer overflow (VideoLAN)
  
• Vendor Homepage (VideoLAN)
  
• VideoLAN-SA-1103 (VideoLAN)