CVE-2011-3623
HighSummary
Multiple stack-based buffer overflows in VideoLAN VLC media player before version 1.0.2 allow remote attackers to execute arbitrary code via crafted ASF, AVI, or MP4 files.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially taking control of the user's system.
Recommendation
It is recommended to update VLC media player to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in VideoLAN VLC media player
See all- CVE-2010-1445High
A heap-based buffer overflow in VideoLAN VLC media player before version 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream in an RTMP session.
- CVE-2010-1444High
The ZIP archive decompressor in VideoLAN VLC media player before version 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.
- CVE-2010-1442High
VideoLAN VLC media player before version 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.
- CVE-2010-1441High
Multiple heap-based buffer overflows in VideoLAN VLC media player before version 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the A/52, DTS, or MPEG Audio decoder.
- CVE-2014-6440Critical
VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service.
- CVE-2016-5108Critical
Buffer overflow in the DecodeAdpcmImaQT function in VideoLAN VLC media player before version 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
Original NVD description (English source)
Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via (1) a crafted ASF file, related to the ASF_ObjectDumpDebug function in modules/demux/asf/libasf.c; (2) a crafted AVI file, related to the AVI_ChunkDumpDebug_level function in modules/demux/avi/libavi.c; or (3) a crafted MP4 file, related to the __MP4_BoxDumpStructure function in modules/demux/mp4/libmp4.c.