KLA10651
Code injection vulnerability in VLC Media Player
Обновлено: 17/06/2019
Дата обнаружения
17/08/2015
Уровень угрозы
Warning
Описание

Lack of content restrictions was found in VLC Media Player. By exploiting this vulnerability malicious users can inject arbitrary code. This vulnerability can be exploited remotely via a specially designed URL.


Technical details

There is lack of URL neutralization in error page generator at VLC web interface. Malicious can exploit this vulnerability by adding script block to URL. PoC and some solution workaround you can find at quantumleap advisory listed at original advisories section.

Пораженные продукты

VLC Media Player versions earlier than 2.2.0

Решение

Update to the latest version
Get VLC

Первичный источник обнаружения
Quantumleap advisory
Оказываемое влияние
?
CI 
[?]
Связанные продукты
VLC media player
CVE-IDS
CVE-2014-97434.3Warning