The remote host is missing an update for the Debian 'vlc' package(s) announced via the DSA-3150-1 advisory. Multiple vulnerabilities in VLC discovered. For the stable distribution (wheezy), these problems have been fixed in version 2.0.3-5+deb7u2. For the upcoming stable distribution (jessie), these problems have been fixed in version 2.2.0~rc2-2. For the unstable distribution (sid), these problems have been fixed in version 2.2.0~rc2-2. We recommend that you upgrade your vlc packages
Reporter | Title | Published | Views | Family All 42 |
---|---|---|---|---|
![]() | Debian DSA-3150-1 : vlc - security update | 3 Feb 201500:00 | – | nessus |
![]() | VLC Media Player < 2.2.0 Multiple Vulnerabilities | 27 Mar 201500:00 | – | nessus |
![]() | GLSA-201603-08 : VLC: Multiple vulnerabilities | 14 Mar 201600:00 | – | nessus |
![]() | vlc multiple security vulnerabilities | 16 Feb 201500:00 | – | securityvulns |
![]() | [SECURITY] [DSA 3150-1] vlc security update | 16 Feb 201500:00 | – | securityvulns |
![]() | Debian Security Advisory DSA 3150-1 (vlc - security update) | 2 Feb 201500:00 | – | openvas |
![]() | Mageia: Security Advisory (MGASA-2015-0053) | 28 Jan 202200:00 | – | openvas |
![]() | Gentoo Security Advisory GLSA 201603-08 | 14 Mar 201600:00 | – | openvas |
![]() | [SECURITY] [DSA 3150-1] vlc security update | 2 Feb 201516:28 | – | debian |
![]() | vlc - security update | 2 Feb 201500:00 | – | osv |
Source | Link |
---|---|
debian | www.debian.org/security/2015/DSA-3150-1 |
security-tracker | www.security-tracker.debian.org/tracker/DSA-3150 |
# SPDX-FileCopyrightText: 2015 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.703150");
script_cve_id("CVE-2014-9626", "CVE-2014-9627", "CVE-2014-9628", "CVE-2014-9629", "CVE-2014-9630");
script_tag(name:"creation_date", value:"2015-02-01 23:00:00 +0000 (Sun, 01 Feb 2015)");
script_version("2024-02-02T05:06:05+0000");
script_tag(name:"last_modification", value:"2024-02-02 05:06:05 +0000 (Fri, 02 Feb 2024)");
script_tag(name:"cvss_base", value:"6.8");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2020-01-29 16:17:38 +0000 (Wed, 29 Jan 2020)");
script_name("Debian: Security Advisory (DSA-3150-1)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2015 Greenbone AG");
script_family("Debian Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/debian_linux", "ssh/login/packages", re:"ssh/login/release=DEB7");
script_xref(name:"Advisory-ID", value:"DSA-3150-1");
script_xref(name:"URL", value:"https://www.debian.org/security/2015/DSA-3150-1");
script_xref(name:"URL", value:"https://security-tracker.debian.org/tracker/DSA-3150");
script_tag(name:"summary", value:"The remote host is missing an update for the Debian 'vlc' package(s) announced via the DSA-3150-1 advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");
script_tag(name:"insight", value:"Fabian Yamaguchi discovered multiple vulnerabilities in VLC, a multimedia player and streamer:
CVE-2014-9626
The MP4 demuxer, when parsing string boxes, did not properly check the length of the box, leading to a possible integer underflow when using this length value in a call to memcpy(). This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files.
CVE-2014-9627
The MP4 demuxer, when parsing string boxes, did not properly check that the conversion of the box length from 64bit integer to 32bit integer on 32bit platforms did not cause a truncation, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files.
CVE-2014-9628
The MP4 demuxer, when parsing string boxes, did not properly check the length of the box, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution via crafted MP4 files.
CVE-2014-9629
The Dirac and Schroedinger encoders did not properly check for an integer overflow on 32bit platforms, leading to a possible buffer overflow. This could allow remote attackers to cause a denial of service (crash) or arbitrary code execution.
For the stable distribution (wheezy), these problems have been fixed in version 2.0.3-5+deb7u2.
For the upcoming stable distribution (jessie), these problems have been fixed in version 2.2.0~rc2-2.
For the unstable distribution (sid), these problems have been fixed in version 2.2.0~rc2-2.
We recommend that you upgrade your vlc packages.");
script_tag(name:"affected", value:"'vlc' package(s) on Debian 7.");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"package");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-deb.inc");
release = dpkg_get_ssh_release();
if(!release)
exit(0);
res = "";
report = "";
if(release == "DEB7") {
if(!isnull(res = isdpkgvuln(pkg:"libvlc-dev", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libvlc-dev", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libvlc5", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libvlc5", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libvlccore-dev", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libvlccore-dev", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libvlccore5", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"libvlccore5", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-data", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-dbg", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-dbg", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-nox", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-nox", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-fluidsynth", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-fluidsynth", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-jack", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-jack", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-notify", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-notify", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-pulse", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-pulse", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-sdl", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-sdl", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-svg", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-svg", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-zvbi", ver:"2.0.3-5+deb7u2", rls:"DEB7"))) {
report += res;
}
if(!isnull(res = isdpkgvuln(pkg:"vlc-plugin-zvbi", ver:"2.0.3-5+deb7u2+b1", rls:"DEB7"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
exit(0);
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo