Kaspersky ID:
KLA11023
Дата обнаружения:
23/05/2017
Обновлено:
22/01/2024

Описание

Multiple serious vulnerabilities have been found in VideoLAN VLC Media Player. Malicious users can exploit these vulnerabilities to cause a denial of service or execute arbitrary code.

Below is a complete list of vulnerabilities:

  1. Heap out-of-bound read in CreateHtmlSubtitle and in ParseJSS can be exploited via a specially designed subtitles file possibly to cause a denial of service;
  2. Potential heap based buffer overflow in Parse JSS can be exploited via a specially designed subtitles file to execute arbitrary code;
  3. Heap out-of-bound read in ParseJSS can be exploited via a specially designed subtitles file possibly to cause a denial of service.

Technical details

Vulnerabilities (1) exists because of missing check of string termination and allow to read data beyond allocated memory.

Vulnerability (2) exists because of skipping NULL terminator in input strings.

Vulnerability (3) exists because check of string length is missed.

Первичный источник обнаружения

Эксплуатация

Public exploits exist for this vulnerability.

Связанные продукты

Список CVE

  • CVE-2017-8310
    warning
  • CVE-2017-8311
    high
  • CVE-2017-8312
    warning
  • CVE-2017-8313
    warning

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com

Нашли неточность в описании этой уязвимости? Дайте нам знать!
Встречай новый Kaspersky!
Каждая минута твоей онлайн-жизни заслуживает топовой защиты.
Узнать больше
Kaspersky IT Security Calculator:
Оцените ваш профиль кибербезопасности
Узнать больше
Confirm changes?
Your message has been sent successfully.