CVE-2008-4686

2008-10-2218:00:01

CWE-189

[email protected]

web.nvd.nist.gov

cve-2008-4686

integer overflows

ty demux plugin

videolan

vlc media player

remote code execution

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

High

0.753 High

EPSS

Percentile

98.2%

JSON

Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.

Affected configurations

NVD

Node

videolanvlc_media_playerMatch0.9.0

videolanvlc_media_playerMatch0.9.1

videolanvlc_media_playerMatch0.9.2

videolanvlc_media_playerMatch0.9.3

videolanvlc_media_playerMatch0.9.4

CPENameOperatorVersion
videolan:vlc_media_playervideolan vlc media playereq0.9.0
videolan:vlc_media_playervideolan vlc media playereq0.9.1
videolan:vlc_media_playervideolan vlc media playereq0.9.2
videolan:vlc_media_playervideolan vlc media playereq0.9.3
videolan:vlc_media_playervideolan vlc media playereq0.9.4

CPE	Name	Operator	Version
videolan:vlc_media_player	videolan vlc media player	eq	0.9.0
videolan:vlc_media_player	videolan vlc media player	eq	0.9.1
videolan:vlc_media_player	videolan vlc media player	eq	0.9.2
videolan:vlc_media_player	videolan vlc media player	eq	0.9.3
videolan:vlc_media_player	videolan vlc media player	eq	0.9.4