CVE-2010-2937

Gentoo Linux Security Advisory 201411-01

Severity Score

5.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly process ID3v2 tags, which allows remote attackers to cause a denial of service (application crash) via a crafted media file.

La función ReadMetaFromId3v2 en taglib.cpp en el plugin TagLib en VideoLAN VLC media player v0.9.0 hasta v1.1.2 no procesa adecuadamente las etiquetas ID3v2, lo que permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través de un archivo media manipulado.

Multiple vulnerabilities have been found in VLC, the worst of which could lead to user-assisted execution of arbitrary code. Versions less than 2.1.2 are affected.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-08-04 CVE Reserved
2010-08-20 CVE Published
2024-08-07 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (6)

URL	Tag	Source
http://git.videolan.org/?p=vlc/vlc-1.0.git%3Ba=commit%3Bh=22a22e356c9d93993086810b2e25b59b55925b3a	X_refsource_confirm
http://git.videolan.org/?p=vlc/vlc-1.1.git%3Ba=commit%3Bh=24918843e57c7962e28fcb01845adce82bed6516	X_refsource_confirm
http://www.securityfocus.com/bid/42386	Vdb Entry
http://www.vupen.com/english/advisories/2010/2087	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14676	Signature

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www.videolan.org/security/sa1004.html	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.0 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.0"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.1 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.1"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.2 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.2"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.3 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.3"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.4 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.4"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.5 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.5"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.6 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.6"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.7 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.7"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.8a Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.8a"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.9 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.9"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.9a Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.9a"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				0.9.10 Search vendor "Videolan" for product "Vlc Media Player" and version "0.9.10"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.0.0 Search vendor "Videolan" for product "Vlc Media Player" and version "1.0.0"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.0.1 Search vendor "Videolan" for product "Vlc Media Player" and version "1.0.1"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.0.2 Search vendor "Videolan" for product "Vlc Media Player" and version "1.0.2"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.0.3 Search vendor "Videolan" for product "Vlc Media Player" and version "1.0.3"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.0.4 Search vendor "Videolan" for product "Vlc Media Player" and version "1.0.4"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.0.5 Search vendor "Videolan" for product "Vlc Media Player" and version "1.0.5"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.0.6 Search vendor "Videolan" for product "Vlc Media Player" and version "1.0.6"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.1.0 Search vendor "Videolan" for product "Vlc Media Player" and version "1.1.0"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.1.1 Search vendor "Videolan" for product "Vlc Media Player" and version "1.1.1"		-		Affected
Videolan Search vendor "Videolan"		Vlc Media Player Search vendor "Videolan" for product "Vlc Media Player"				1.1.2 Search vendor "Videolan" for product "Vlc Media Player" and version "1.1.2"		-		Affected