CVE-2017-8311
HighSummary
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before version 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
Risk Assessment
Attackers may exploit this vulnerability to execute arbitrary code remotely, potentially leading to full system compromise. Organizations should be aware of the risks associated with playing unverified subtitle files.
Recommendation
It is recommended to update VLC to version 2.2.5 or later and to avoid opening subtitle files from untrusted sources.
Other vulnerabilities in VideoLAN VLC
See all- CVE-2023-47360High
Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
- CVE-2023-47359Critical
Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in memory corruption.
Original NVD description (English source)
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.