ZeroBox Vulnerability Database

漏洞起因
输入验证错误
危险等级
低
 
影响系统
VideoLAN VLC media player 1.1.4
VideoLAN VLC media player 1.1.4
VideoLAN VLC media player 1.1.3
VideoLAN VLC media player 1.1.2
VideoLAN VLC media player 1.1.1
VideoLAN VLC media player 1.1
VideoLAN VLC media player 1.0.6
VideoLAN VLC media player 1.0.5
VideoLAN VLC media player 1.0.3
VideoLAN VLC media player 1.0.2
VideoLAN VLC media player 1.0.1
VideoLAN VLC media player 1.0
VideoLAN VLC media player 0.9.9
VideoLAN VLC media player 0.9.7
VideoLAN VLC media player 0.9.6
VideoLAN VLC media player 0.9.5
VideoLAN VLC media player 0.9.4
VideoLAN VLC media player 0.9.3
VideoLAN VLC media player 0.9.2
VideoLAN VLC media player 0.9.1
VideoLAN VLC media player 0.9
VideoLAN VLC media player 0.8.6 i
VideoLAN VLC media player 0.8.6 h
VideoLAN VLC media player 0.8.6 g
VideoLAN VLC media player 0.8.6 d
VideoLAN VLC media player 0.8.6
+ Debian Linux 4.0 sparc
+ Debian Linux 4.0 s/390
+ Debian Linux 4.0 powerpc
+ Debian Linux 4.0 mipsel
+ Debian Linux 4.0 mips
+ Debian Linux 4.0 m68k
+ Debian Linux 4.0 ia-64
+ Debian Linux 4.0 ia-32
+ Debian Linux 4.0 hppa
+ Debian Linux 4.0 arm
+ Debian Linux 4.0 amd64
+ Debian Linux 4.0 alpha
+ Debian Linux 4.0
VideoLAN VLC media player 0.6.8
VideoLAN VLC media player 0.5
VideoLAN VLC media player 1.1.5
VideoLAN VLC media player 1.1.3
VideoLAN VLC media player 1.1.2
VideoLAN VLC media player 1.1.1
VideoLAN VLC media player 1.1.0
VideoLAN VLC media player 1.0.4
VideoLAN VLC media player 0.9.8a
VideoLAN VLC media player 0.8.6f
VideoLAN VLC media player 0.8.6e
VideoLAN VLC media player 0.8.6c
VideoLAN VLC media player 0.8.6b
VideoLAN VLC media player 0.8.6a
 
不受影响系统
VideoLAN VLC media player 1.1.6
 
危害
远程攻击者可以利用漏洞以应用程序安全上下文执行任意指令。
 
攻击所需条件
攻击者必须够建恶意媒体文件，诱使用户访问。
 
漏洞信息
VLC Media Player是一款流行的多媒体播放程序。
当解析非法Real Media文件的头字段数据时存在整数溢出，攻击者构建恶意媒体文件，诱使用户打开，可触发基于堆的缓冲区溢出。
成功利用漏洞可以应用程序安全上下文执行任意指令。
 
测试方法
 
厂商解决方案
VideoLAN VLC media player 1.1.6已经修复此漏洞，建议用户下载使用：
http://www.videolan.org/
 
漏洞提供者
Dan Rosenberg