CVSS: 6.8EPSS: 2%CPEs: 1EXPL: 2CVE-2008-1489 – Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2008-1489
Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box that triggers a heap-based buffer overflow, a different vulnerability than CVE-2008-0984. Desbordamiento de entero en la función MP4_ReadBox_rdrf de libmp4.c para VLC 0.8.6e permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente ejecutar código de su elección a través de una MP4 RDRF box manipulada que dispara un desbordamiento de búfer basado en montículo, una vulnerabilidad distinta a CVE-2008-0984. • https://www.exploit-db.com/exploits/5498 http://secunia.com/advisories/29503 http://secunia.com/advisories/29766 http://secunia.com/advisories/29800 http://security.gentoo.org/glsa/glsa-200804-25.xml http://trac.videolan.org/vlc/changeset/09572892df7e72c0d4e598c0b5e076cf330d8b0a http://wiki.videolan.org/Changelog/0.8.6f http://www.debian.org/security/2008/dsa-1543 http://www.securityfocus.com/bid/28433 http://www.videolan.org/security/sa0803.php http://www.vupen.com/english/ • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 71%CPEs: 1EXPL: 2CVE-2007-6682 – VideoLAN VLC Media Player 0.8.6d - 'httpd_FileCallBack' Remote Format String
https://notcve.org/view.php?id=CVE-2007-6682
Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via format string specifiers in the Connection parameter. Vulnerabilidad de cadena de formato en la función httpd_FileCallBack (network/httpd.c) de VideoLAN VLC 0.8.6d permite a atacantes remotos ejecutar código de su elección mediante especificadores de cadenas de formato en el parámetro Connection. • https://www.exploit-db.com/exploits/5519 http://aluigi.altervista.org/adv/vlcboffs-adv.txt http://osvdb.org/42208 http://secunia.com/advisories/28233 http://secunia.com/advisories/29284 http://secunia.com/advisories/29766 http://securityreason.com/securityalert/3550 http://trac.videolan.org/vlc/changeset/23839 http://www.debian.org/security/2008/dsa-1543 http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml http://www.securityfocus.com/archive/1/485488/30/0/ •
CVSS: 7.5EPSS: 30%CPEs: 1EXPL: 2CVE-2007-6681 – Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-6681
Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long subtitle in a (1) MicroDvd, (2) SSA, and (3) Vplayer file. Desbordamiento de búfer basado en pila en modules/demux/subtitle.c de VideoLAN VLC 0.8.6d permite a atacantes remotos ejecutar código de su elección mediante un subtítulo largo en un fichero (1) MicroDvd, (2) SSA, y (3) Vplayer. • https://www.exploit-db.com/exploits/5498 http://aluigi.altervista.org/adv/vlcboffs-adv.txt http://mailman.videolan.org/pipermail/vlc-devel/2007-June/032672.html http://mailman.videolan.org/pipermail/vlc-devel/2007-June/033394.html http://osvdb.org/42207 http://secunia.com/advisories/28233 http://secunia.com/advisories/29284 http://secunia.com/advisories/29766 http://secunia.com/advisories/29800 http://security.gentoo.org/glsa/glsa-200804-25.xml http://securityreason.com/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2007-6683
https://notcve.org/view.php?id=CVE-2007-6683
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability. La extensión de navegación de VideoLAN VLC 0.8.6d permite a atacantes remotos sobrescribir ficheros de su elección mediante (1) la opción :demuxdump-file en un nombre de fichero de una lista de reproducción, o (2) una sentencia EXTVLCOPT en un fichero MP3, posiblemente una vulnerabilidad de inyección de argumento. • http://mailman.videolan.org/pipermail/vlc-devel/2007-December/037726.html http://osvdb.org/42205 http://osvdb.org/42206 http://secunia.com/advisories/29284 http://secunia.com/advisories/29766 http://www.debian.org/security/2008/dsa-1543 http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml http://www.securityfocus.com/bid/28712 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14619 https://trac.videolan.org/vlc/changeset/23197 https •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2007-6684
https://notcve.org/view.php?id=CVE-2007-6684
The RTSP module in VideoLAN VLC 0.8.6d allows remote attackers to cause a denial of service (crash) via a request without a Transport parameter, which triggers a NULL pointer dereference. El módulo RTSP de VideoLAN VLC 0.8.6d permite a atacantes remotos provocar una denegación de servicio (caída) mediante una petición sin el parámetro Transfer, lo cual provoca una referencia a un puntero nulo. • http://mailman.videolan.org/pipermail/vlc-devel/2007-September/034722.html http://secunia.com/advisories/29284 http://trac.videolan.org/vlc/changeset/22023 http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14876 • CWE-20: Improper Input Validation •