{"bulletinFamily": "scanner", "viewCount": 0, "naslFamily": "Debian Local Security Checks", "reporter": "Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net", "references": ["http://www.debian.org/security/2014/dsa-2973.html"], "description": "Multiple buffer overflows have been found in the VideoLAN media player.\nProcessing malformed subtitles or movie files could lead to denial of\nservice and potentially the execution of arbitrary code.", "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvelist", "hash": "e53ed41bf7a296be9df98545b2af6849"}, {"key": "cvss", "hash": "2076413bdcb42307d016f5286cbae795"}, {"key": "description", "hash": "5b0eac581f9a476163cf363364ae4f97"}, {"key": "href", "hash": "dfd440f95420a3e6797d5dbd61e40ac1"}, {"key": "modified", "hash": "bf6febede5ca68e35fdf4a0f47b4ef18"}, {"key": "naslFamily", "hash": "74562d71b087df9eabd0c21f99b132cc"}, {"key": "pluginID", "hash": "4aba7e14b0ee478564d53995797838c0"}, {"key": "published", "hash": "729d81ab74dae7300a4e8eaf1ff82c00"}, {"key": "references", "hash": "bf864000477cb02c9cc7ed1e6e7f136f"}, {"key": "reporter", "hash": "d360c61f7849405ebf50eccc7225e087"}, {"key": "sourceData", "hash": "8cb438b6d3d54587d23154b22c4ffd7b"}, {"key": "title", "hash": "014934dff028a9b37898fe16a5c3e0c2"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}], "href": "http://plugins.openvas.org/nasl.php?oid=702973", "modified": "2017-07-11T00:00:00", "objectVersion": "1.3", "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "vulnersScore": 7.5}, "id": "OPENVAS:702973", "title": "Debian Security Advisory DSA 2973-1 (vlc - security update)", "hash": "c25b44b7b2a977b4969473a25129c1fc1ee8b089076e51afb787216460056149", "edition": 3, "published": "2014-07-07T00:00:00", "type": "openvas", "history": [{"lastseen": "2017-07-24T12:48:52", "bulletin": {"hash": "a83b5992f8888267233956d02a81abaefe5ba0c1c8251ac9edd76c35303b30ec", "viewCount": 0, "reporter": "Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net", "references": ["http://www.debian.org/security/2014/dsa-2973.html"], "description": "Multiple buffer overflows have been found in the VideoLAN media player.\nProcessing malformed subtitles or movie files could lead to denial of\nservice and potentially the execution of arbitrary code.", "hashmap": [{"key": "cvss", "hash": "2076413bdcb42307d016f5286cbae795"}, {"key": "sourceData", "hash": "7b45525212736e59ad938c06f0a32e38"}, {"key": "cvelist", "hash": "e53ed41bf7a296be9df98545b2af6849"}, {"key": "href", "hash": "dfd440f95420a3e6797d5dbd61e40ac1"}, {"key": "pluginID", "hash": "4aba7e14b0ee478564d53995797838c0"}, {"key": "references", "hash": "bf864000477cb02c9cc7ed1e6e7f136f"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}, {"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "modified", "hash": "d89cc672a6266551218ef8145d1f22e2"}, {"key": "title", "hash": "014934dff028a9b37898fe16a5c3e0c2"}, {"key": "reporter", "hash": "d360c61f7849405ebf50eccc7225e087"}, {"key": "description", "hash": "5b0eac581f9a476163cf363364ae4f97"}, {"key": "naslFamily", "hash": "74562d71b087df9eabd0c21f99b132cc"}, {"key": "published", "hash": "729d81ab74dae7300a4e8eaf1ff82c00"}], "naslFamily": "Debian Local Security Checks", "modified": "2017-07-07T00:00:00", "objectVersion": "1.3", "href": "http://plugins.openvas.org/nasl.php?oid=702973", "published": "2014-07-07T00:00:00", "enchantments": {}, "id": "OPENVAS:702973", "title": "Debian Security Advisory DSA 2973-1 (vlc - security update)", "bulletinFamily": "scanner", "edition": 2, "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2973.nasl 6610 2017-07-07 12:06:40Z cfischer $\n# Auto-generated from advisory DSA 2973-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_affected = \"vlc on Debian Linux\";\ntag_insight = \"VLC is the VideoLAN project's media player. It plays MPEG, MPEG-2, MPEG-4,\nDivX, MOV, WMV, QuickTime, WebM, FLAC, MP3, Ogg/Vorbis files, DVDs, VCDs,\npodcasts, and multimedia streams from various network sources.\";\ntag_solution = \"For the stable distribution (wheezy), these problems have been fixed in\nversion 2.0.3-5+deb7u1.\n\nFor the testing distribution (jessie), these problems have been fixed in\nversion 2.1.0-1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.1.0-1.\n\nWe recommend that you upgrade your vlc packages.\";\ntag_summary = \"Multiple buffer overflows have been found in the VideoLAN media player.\nProcessing malformed subtitles or movie files could lead to denial of\nservice and potentially the execution of arbitrary code.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(702973);\n script_version(\"$Revision: 6610 $\");\n script_cve_id(\"CVE-2013-1868\", \"CVE-2013-1954\", \"CVE-2013-4388\");\n script_name(\"Debian Security Advisory DSA 2973-1 (vlc - security update)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-07 14:06:40 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2014-07-07 00:00:00 +0200 (Mon, 07 Jul 2014)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2014/dsa-2973.html\");\n\n script_summary(\"Debian Security Advisory DSA 2973-1 (vlc - security update)\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "type": "openvas", "history": [], "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "cvelist": ["CVE-2013-1954", "CVE-2013-1868", "CVE-2013-4388"], "lastseen": "2017-07-24T12:48:52", "pluginID": "702973"}, "differentElements": ["modified", "sourceData"], "edition": 2}, {"lastseen": "2017-07-02T21:09:41", "bulletin": {"hash": "91e9bdbc66cb6ca92cc112bf533c9c5a4584df5e31f73ce7007a2a3ceed7a26a", "viewCount": 0, "reporter": "Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net", "references": ["http://www.debian.org/security/2014/dsa-2973.html"], "description": "Multiple buffer overflows have been found in the VideoLAN media player.\nProcessing malformed subtitles or movie files could lead to denial of\nservice and potentially the execution of arbitrary code.", "hashmap": [{"key": "sourceData", "hash": "739ade56b30118a2ce91b493b680517c"}, {"key": "cvss", "hash": "2076413bdcb42307d016f5286cbae795"}, {"key": "cvelist", "hash": "e53ed41bf7a296be9df98545b2af6849"}, {"key": "href", "hash": "dfd440f95420a3e6797d5dbd61e40ac1"}, {"key": "pluginID", "hash": "4aba7e14b0ee478564d53995797838c0"}, {"key": "references", "hash": "bf864000477cb02c9cc7ed1e6e7f136f"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}, {"key": "modified", "hash": "8a8dd8f3315ed34b241fe19dba85c623"}, {"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "title", "hash": "014934dff028a9b37898fe16a5c3e0c2"}, {"key": "reporter", "hash": "d360c61f7849405ebf50eccc7225e087"}, {"key": "description", "hash": "5b0eac581f9a476163cf363364ae4f97"}, {"key": "naslFamily", "hash": "74562d71b087df9eabd0c21f99b132cc"}, {"key": "published", "hash": "729d81ab74dae7300a4e8eaf1ff82c00"}], "naslFamily": "Debian Local Security Checks", "modified": "2016-03-03T00:00:00", "objectVersion": "1.3", "href": "http://plugins.openvas.org/nasl.php?oid=702973", "published": "2014-07-07T00:00:00", "enchantments": {}, "id": "OPENVAS:702973", "title": "Debian Security Advisory DSA 2973-1 (vlc - security update)", "bulletinFamily": "scanner", "edition": 1, "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2973.nasl 2767 2016-03-03 09:38:42Z benallard $\n# Auto-generated from advisory DSA 2973-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_affected = \"vlc on Debian Linux\";\ntag_insight = \"VLC is the VideoLAN project's media player. It plays MPEG, MPEG-2, MPEG-4,\nDivX, MOV, WMV, QuickTime, WebM, FLAC, MP3, Ogg/Vorbis files, DVDs, VCDs,\npodcasts, and multimedia streams from various network sources.\";\ntag_solution = \"For the stable distribution (wheezy), these problems have been fixed in\nversion 2.0.3-5+deb7u1.\n\nFor the testing distribution (jessie), these problems have been fixed in\nversion 2.1.0-1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.1.0-1.\n\nWe recommend that you upgrade your vlc packages.\";\ntag_summary = \"Multiple buffer overflows have been found in the VideoLAN media player.\nProcessing malformed subtitles or movie files could lead to denial of\nservice and potentially the execution of arbitrary code.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(702973);\n script_version(\"$Revision: 2767 $\");\n script_cve_id(\"CVE-2013-1868\", \"CVE-2013-1954\", \"CVE-2013-4388\");\n script_name(\"Debian Security Advisory DSA 2973-1 (vlc - security update)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2016-03-03 10:38:42 +0100 (Thu, 03 Mar 2016) $\");\n script_tag(name: \"creation_date\", value:\"2014-07-07 00:00:00 +0200 (Mon, 07 Jul 2014)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2014/dsa-2973.html\");\n\n script_summary(\"Debian Security Advisory DSA 2973-1 (vlc - security update)\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"HostDetails/OS/cpe:/o:debian:debian_linux\", \"login/SSH/success\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "type": "openvas", "history": [], "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "cvelist": ["CVE-2013-1954", "CVE-2013-1868", "CVE-2013-4388"], "lastseen": "2017-07-02T21:09:41", "pluginID": "702973"}, "differentElements": ["modified", "sourceData"], "edition": 1}], "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "cvelist": ["CVE-2013-1954", "CVE-2013-1868", "CVE-2013-4388"], "lastseen": "2017-07-26T08:48:55", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2973.nasl 6663 2017-07-11 09:58:05Z teissa $\n# Auto-generated from advisory DSA 2973-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_affected = \"vlc on Debian Linux\";\ntag_insight = \"VLC is the VideoLAN project's media player. It plays MPEG, MPEG-2, MPEG-4,\nDivX, MOV, WMV, QuickTime, WebM, FLAC, MP3, Ogg/Vorbis files, DVDs, VCDs,\npodcasts, and multimedia streams from various network sources.\";\ntag_solution = \"For the stable distribution (wheezy), these problems have been fixed in\nversion 2.0.3-5+deb7u1.\n\nFor the testing distribution (jessie), these problems have been fixed in\nversion 2.1.0-1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.1.0-1.\n\nWe recommend that you upgrade your vlc packages.\";\ntag_summary = \"Multiple buffer overflows have been found in the VideoLAN media player.\nProcessing malformed subtitles or movie files could lead to denial of\nservice and potentially the execution of arbitrary code.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(702973);\n script_version(\"$Revision: 6663 $\");\n script_cve_id(\"CVE-2013-1868\", \"CVE-2013-1954\", \"CVE-2013-4388\");\n script_name(\"Debian Security Advisory DSA 2973-1 (vlc - security update)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-11 11:58:05 +0200 (Tue, 11 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2014-07-07 00:00:00 +0200 (Mon, 07 Jul 2014)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2014/dsa-2973.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "pluginID": "702973"}

{"cve": [{"lastseen": "2017-09-19T13:38:51", "references": ["http://www.openwall.com/lists/oss-security/2013/10/01/2", "http://www.videolan.org/developers/vlc-branch/NEWS", "http://git.videolan.org/?p=vlc.git;a=commitdiff;h=9794ec1cd268c04c8bca13a5fae15df6594dff3e", "http://www.securitytracker.com/id/1029120", "http://www.securityfocus.com/bid/62724"], "edition": 3, "description": "Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.", "reporter": "NVD", "published": "2013-10-11T18:55:40", "title": "CVE-2013-4388", "type": "cve", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "assessment": {"system": "http://oval.mitre.org/XMLSchema/oval-definitions-5", "name": "oval:org.mitre.oval:def:18086", "href": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18086"}, "bulletinFamily": "NVD", "cvelist": ["CVE-2013-4388"], "scanner": [], "cpe": ["cpe:/a:videolan:vlc_media_player:2.0.5", "cpe:/a:videolan:vlc_media_player:2.0.3", "cpe:/a:videolan:vlc_media_player:2.0.1", "cpe:/a:videolan:vlc_media_player:2.0.2", "cpe:/a:videolan:vlc_media_player:2.0.4", "cpe:/a:videolan:vlc_media_player:2.0.7", "cpe:/a:videolan:vlc_media_player:2.0.0", "cpe:/a:videolan:vlc_media_player:2.0.6"], "modified": "2017-09-18T21:36:46", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4388", "id": "CVE-2013-4388", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-09-19T13:38:42", "references": ["http://www.videolan.org/security/sa1301.html", "http://marc.info/?l=oss-security&m=136367945627336&w=2", "http://www.securityfocus.com/bid/57079"], "edition": 2, "description": "Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.", "reporter": "NVD", "published": "2013-07-10T15:55:04", "title": "CVE-2013-1868", "type": "cve", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "assessment": {"system": "http://oval.mitre.org/XMLSchema/oval-definitions-5", "name": "oval:org.mitre.oval:def:17226", "href": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17226"}, "bulletinFamily": "NVD", "cvelist": ["CVE-2013-1868"], "scanner": [], "cpe": ["cpe:/a:videolan:vlc_media_player:2.0.3", "cpe:/a:videolan:vlc_media_player:2.0.1", "cpe:/a:videolan:vlc_media_player:2.0.2", "cpe:/a:videolan:vlc_media_player:2.0.4", "cpe:/a:videolan:vlc_media_player:2.0.0"], "modified": "2017-09-18T21:36:14", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1868", "id": "CVE-2013-1868", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-09-19T13:38:42", "references": ["http://marc.info/?l=oss-security&m=136610343501731&w=2", "http://marc.info/?l=oss-security&m=136593191416152&w=2", "http://trac.videolan.org/vlc/ticket/8024", "http://www.videolan.org/security/sa1302.html", "http://git.videolan.org/?p=vlc.git;a=commitdiff;h=b31ce523331aa3a6e620b68cdfe3f161d519631e", "http://www.securityfocus.com/bid/57333"], "edition": 2, "description": "The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.", "reporter": "NVD", "published": "2013-07-10T15:55:04", "title": "CVE-2013-1954", "type": "cve", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "assessment": {"system": "http://oval.mitre.org/XMLSchema/oval-definitions-5", "name": "oval:org.mitre.oval:def:17023", "href": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17023"}, "bulletinFamily": "NVD", "cvelist": ["CVE-2013-1954"], "scanner": [], "cpe": ["cpe:/a:videolan:vlc_media_player:2.0.5", "cpe:/a:videolan:vlc_media_player:2.0.3", "cpe:/a:videolan:vlc_media_player:2.0.1", "cpe:/a:videolan:vlc_media_player:2.0.2", "cpe:/a:videolan:vlc_media_player:2.0.4", "cpe:/a:videolan:vlc_media_player:2.0.0"], "modified": "2017-09-18T21:36:14", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1954", "id": "CVE-2013-1954", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:56", "references": ["https://vulners.com/securityvulns/securityvulns:doc:30954"], "description": "Buffer overflows on different video formats parsing.", "edition": 1, "reporter": "BUGTRAQ", "published": "2014-07-28T00:00:00", "title": "Videolan vlc multiple security vulnerabilities", "type": "securityvulns", "enchantments": {"score": {"modified": "2018-08-31T11:09:56", "vector": "NONE", "value": 10.0}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "vlc", "version": "2.0", "operator": "eq"}], "cvelist": ["CVE-2013-1954", "CVE-2013-1868", "CVE-2013-4388"], "modified": "2014-07-28T00:00:00", "id": "SECURITYVULNS:VULN:13889", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13889", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:52", "references": [], "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2973-1 security@debian.org\r\nhttp://www.debian.org/security/ Moritz Muehlenhoff\r\nJuly 07, 2014 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : vlc\r\nCVE ID : CVE-2013-1868 CVE-2013-1954 CVE-2013-4388\r\n\r\nMultiple buffer overflows have been found in the VideoLAN media player.\r\nProcessing malformed subtitles or movie files could lead to denial of\r\nservice and potentially the execution of arbitrary code.\r\n\r\nFor the stable distribution &#40;wheezy&#41;, these problems have been fixed in\r\nversion 2.0.3-5+deb7u1.\r\n\r\nFor the testing distribution &#40;jessie&#41;, these problems have been fixed in\r\nversion 2.1.0-1.\r\n\r\nFor the unstable distribution &#40;sid&#41;, these problems have been fixed in\r\nversion 2.1.0-1.\r\n\r\nWe recommend that you upgrade your vlc packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1\r\n\r\niQIcBAEBAgAGBQJTuxLyAAoJEBDCk7bDfE422awP/A6q2UrLQI47VDpmNhym/iq8\r\nxTaHDKVOg9liWJ/tcM5Pkm76lCkHabMhCbnajLmGHWDbJUarjgHoDdhJdeW6GtT9\r\n2HOd9uWx0s64X5hy8jfS++2t8zEb3ZIQ+OpZC0vTj/6nbMYuO6+OR67ONLUIzRFa\r\ntFRaitIT6C10hUUkI9ybY5oin9ixDYs/T4UFVJ+iq7SoREJsngg3U4cmJPIueYQ8\r\n5xYaSDWUXzW2+/VlNTyOkYRQ02by2Q4YPMy/Y8ON/Xfey6Awy59mag2TFfpUBUFk\r\nlJGYxR8gtwGx4KFMJiNde3HvVzpiT6W2X5S02URMYmV5APkgkF9UvAaQLk/YnnR4\r\nrKKtEmV21ec1wVrTYXAPA/R4/TrMb2/tJ5/yYxywTmNl74NoqRPHOpgyzp6wCMmO\r\n9hdFWR7CZrVe2X1TL48W5S/carvkfra3ZW66hbFao7h4lmQ/9SoZGb8dps6qxONt\r\nomcuPDoSuVljtbr/t+na82v1BXX/k4o/7uWQ94KbTqaMjVEf4yC37yokb7a2ngXP\r\nr7AJ/BHJGvsIo4y1Ccv4BxWqQ3ii5EogTyR8/S4v2O7lhvn2JOMWzGcCvf/d8qgM\r\nlGajkIWSpGlH+FrcaZXojzbwAFTJjZwewH7uxBLIAewz654GzXqStYO8uQ220vjA\r\nvTesFwVSjcZR8Gvmz7Jb\r\n=K5Fy\r\n-----END PGP SIGNATURE-----\r\n\r\n", "edition": 1, "reporter": "Securityvulns", "published": "2014-07-28T00:00:00", "title": "[SECURITY] [DSA 2973-1] vlc security update", "type": "securityvulns", "enchantments": {"score": {"modified": "2018-08-31T11:10:52", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2013-1954", "CVE-2013-1868", "CVE-2013-4388"], "modified": "2014-07-28T00:00:00", "id": "SECURITYVULNS:DOC:30954", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30954", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2018-09-01T23:55:09", "references": ["http://www.debian.org/security/2014/dsa-2973.html"], "pluginID": "1361412562310702973", "description": "Multiple buffer overflows have been found in the VideoLAN media player.\nProcessing malformed subtitles or movie files could lead to denial of\nservice and potentially the execution of arbitrary code.", "edition": 3, "reporter": "Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net", "published": "2014-07-07T00:00:00", "title": "Debian Security Advisory DSA 2973-1 (vlc - security update)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1954", "CVE-2013-1868", "CVE-2013-4388"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:1361412562310702973", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310702973", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2973.nasl 9354 2018-04-06 07:15:32Z cfischer $\n# Auto-generated from advisory DSA 2973-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_affected = \"vlc on Debian Linux\";\ntag_insight = \"VLC is the VideoLAN project's media player. It plays MPEG, MPEG-2, MPEG-4,\nDivX, MOV, WMV, QuickTime, WebM, FLAC, MP3, Ogg/Vorbis files, DVDs, VCDs,\npodcasts, and multimedia streams from various network sources.\";\ntag_solution = \"For the stable distribution (wheezy), these problems have been fixed in\nversion 2.0.3-5+deb7u1.\n\nFor the testing distribution (jessie), these problems have been fixed in\nversion 2.1.0-1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.1.0-1.\n\nWe recommend that you upgrade your vlc packages.\";\ntag_summary = \"Multiple buffer overflows have been found in the VideoLAN media player.\nProcessing malformed subtitles or movie files could lead to denial of\nservice and potentially the execution of arbitrary code.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.702973\");\n script_version(\"$Revision: 9354 $\");\n script_cve_id(\"CVE-2013-1868\", \"CVE-2013-1954\", \"CVE-2013-4388\");\n script_name(\"Debian Security Advisory DSA 2973-1 (vlc - security update)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2018-04-06 09:15:32 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name: \"creation_date\", value:\"2014-07-07 00:00:00 +0200 (Mon, 07 Jul 2014)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2014/dsa-2973.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore-dev\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlccore5\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-data\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-dbg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-fluidsynth\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-jack\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-notify\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-pulse\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svg\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-zvbi\", ver:\"2.0.3-5+deb7u1\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-10-22T16:41:56", "references": ["http://www.videolan.org/news.html", "http://www.openwall.com/lists/oss-security/2013/10/01/2", "http://www.videolan.org/vlc", "http://www.securitytracker.com/id/1029120"], "pluginID": "1361412562310803955", "description": "This host is installed with VLC Media Player and is prone to denial of service\nvulnerability.", "edition": 6, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "published": "2013-10-22T00:00:00", "title": "VLC Media Player mp4a Denial of Service Vulnerability (MAC OS X)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "General", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4388"], "modified": "2018-10-12T00:00:00", "id": "OPENVAS:1361412562310803955", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310803955", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_mp4a_vuln_dos_macosx.nasl 11865 2018-10-12 10:03:43Z cfischer $\n#\n# VLC Media Player mp4a Denial of Service Vulnerability (MAC OS X)\n#\n# Authors:\n# Shashi Kiran N <nskiran@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\nCPE = \"cpe:/a:videolan:vlc_media_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.803955\");\n script_version(\"$Revision: 11865 $\");\n script_cve_id(\"CVE-2013-4388\");\n script_bugtraq_id(62724);\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 12:03:43 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-10-22 19:02:32 +0530 (Tue, 22 Oct 2013)\");\n script_name(\"VLC Media Player mp4a Denial of Service Vulnerability (MAC OS X)\");\n\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers to overflow buffer, cause denial\nof service.\");\n script_tag(name:\"affected\", value:\"VLC media player version 2.0.7 and prior on MAC OS X\");\n script_tag(name:\"insight\", value:\"A flaw exist in mpeg4audio.c file, which to perform adequate boundary checks\non user-supplied input. \");\n script_tag(name:\"solution\", value:\"Upgrade to VLC media player version 2.0.8 or later.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"summary\", value:\"This host is installed with VLC Media Player and is prone to denial of service\nvulnerability.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://www.videolan.org/news.html\");\n script_xref(name:\"URL\", value:\"http://www.securitytracker.com/id/1029120\");\n script_xref(name:\"URL\", value:\"http://www.openwall.com/lists/oss-security/2013/10/01/2\");\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_vlc_media_player_detect_macosx.nasl\");\n script_mandatory_keys(\"VLC/Media/Player/MacOSX/Version\");\n script_xref(name:\"URL\", value:\"http://www.videolan.org/vlc\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nvlcVer = get_app_version(cpe:CPE);\nif(!vlcVer){\n exit(0);\n}\n\nif(version_is_less_equal(version:vlcVer, test_version:\"2.0.7\"))\n{\n security_message( port: 0, data: \"The target host was found to be vulnerable\" );\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-10-22T16:41:56", "references": ["http://www.videolan.org/news.html", "http://www.openwall.com/lists/oss-security/2013/10/01/2", "http://www.videolan.org/vlc", "http://www.securitytracker.com/id/1029120"], "pluginID": "1361412562310803954", "description": "This host is installed with VLC Media Player and is prone to denial of service\nvulnerability.", "edition": 7, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "published": "2013-10-22T00:00:00", "title": "VLC Media Player mp4a Denial of Service Vulnerability (Windows)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "General", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4388"], "modified": "2018-10-12T00:00:00", "id": "OPENVAS:1361412562310803954", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310803954", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_mp4a_vuln_dos_win.nasl 11865 2018-10-12 10:03:43Z cfischer $\n#\n# VLC Media Player mp4a Denial of Service Vulnerability (Windows)\n#\n# Authors:\n# Shashi Kiran N <nskiran@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\nCPE = \"cpe:/a:videolan:vlc_media_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.803954\");\n script_version(\"$Revision: 11865 $\");\n script_cve_id(\"CVE-2013-4388\");\n script_bugtraq_id(62724);\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 12:03:43 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-10-22 19:22:32 +0530 (Tue, 22 Oct 2013)\");\n script_name(\"VLC Media Player mp4a Denial of Service Vulnerability (Windows)\");\n\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers to overflow buffer, cause denial\nof service.\");\n script_tag(name:\"affected\", value:\"VLC media player version 2.0.7 and prior on Windows\");\n script_tag(name:\"insight\", value:\"A flaw exist in mpeg4audio.c file, which to perform adequate boundary checks\non user-supplied input. \");\n script_tag(name:\"solution\", value:\"Upgrade to VLC media player version 2.0.8 or later.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"summary\", value:\"This host is installed with VLC Media Player and is prone to denial of service\nvulnerability.\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://www.videolan.org/news.html\");\n script_xref(name:\"URL\", value:\"http://www.securitytracker.com/id/1029120\");\n script_xref(name:\"URL\", value:\"http://www.openwall.com/lists/oss-security/2013/10/01/2\");\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"secpod_vlc_media_player_detect_win.nasl\");\n script_mandatory_keys(\"VLCPlayer/Win/Installed\");\n script_xref(name:\"URL\", value:\"http://www.videolan.org/vlc\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nvlcVer = get_app_version(cpe:CPE);\nif(!vlcVer){\n exit(0);\n}\n\nif(version_is_less_equal(version:vlcVer, test_version:\"2.0.7\"))\n{\n security_message( port: 0, data: \"The target host was found to be vulnerable\" );\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-12-20T13:23:07", "references": ["http://secunia.com/advisories/51995", "http://www.videolan.org/security/sa1302.html"], "pluginID": "803698", "description": "This host is installed with VLC Media Player and is prone to\nbuffer overflow vulnerability.", "edition": 2, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "published": "2013-07-16T00:00:00", "title": "VLC Media Player Buffer Overflow Vulnerability - July 13 (Windows)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "General", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1954"], "modified": "2017-12-19T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=803698", "id": "OPENVAS:803698", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_bof_vuln_jul13_win.nasl 8174 2017-12-19 12:23:25Z cfischer $\n#\n# VLC Media Player Buffer Overflow Vulnerability - July 13 (Windows)\n#\n# Authors:\n# Arun Kallavi <karun@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:videolan:vlc_media_player\";\n\nif(description)\n{\n script_id(803698);\n script_version(\"$Revision: 8174 $\");\n script_cve_id(\"CVE-2013-1954\");\n script_bugtraq_id(57333);\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-19 13:23:25 +0100 (Tue, 19 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2013-07-16 13:35:48 +0530 (Tue, 16 Jul 2013)\");\n script_name(\"VLC Media Player Buffer Overflow Vulnerability - July 13 (Windows)\");\n\n tag_summary = \"This host is installed with VLC Media Player and is prone to\nbuffer overflow vulnerability.\";\n\n tag_insight = \"Flaw due to error in 'DemuxPacket()' function in the ASF Demuxer component\n(modules/demux/asf/asf.c) when parsing ASF files.\";\n\n tag_vuldetect = \"Get the installed version with the help of detect NVT and check the version\nis vulnerable or not.\";\n\n tag_impact = \"Successful exploitation could allow attackers to execute arbitrary code or\ncause denial of service condition in the context of affected application via\ncrafted ASF file.\n\n Impact Level: System/Application\";\n\n tag_affected = \"VLC media player version 2.0.5 and prior on Windows\";\n\n tag_solution = \"Upgrade to VLC media player version 2.0.6 or later,\nFor updates refer to http://www.videolan.org/vlc\";\n\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"vuldetect\" , value : tag_vuldetect);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name : \"URL\" , value : \"http://secunia.com/advisories/51995\");\n script_xref(name : \"URL\" , value : \"http://www.videolan.org/security/sa1302.html\");\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"secpod_vlc_media_player_detect_win.nasl\");\n script_mandatory_keys(\"VLCPlayer/Win/Installed\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\ninfos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE );\nvers = infos['version'];\npath = infos['location'];\n\n## Check for VLC Media Player Version <= 2.0.5\nif( version_is_less_equal( version:vers, test_version:\"2.0.5\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"2.0.6\", install_path:path );\n security_message( port:0, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-02T21:11:18", "references": ["http://secunia.com/advisories/51995", "http://www.videolan.org/security/sa1302.html"], "pluginID": "803699", "description": "This host is installed with VLC Media Player and is prone to\nbuffer overflow vulnerability.", "edition": 1, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "published": "2013-07-16T00:00:00", "title": "VLC Media Player Buffer Overflow Vulnerability - July 13 (MAC OS X)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "General", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1954"], "modified": "2017-05-08T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=803699", "id": "OPENVAS:803699", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_bof_vuln_jul13_macosx.nasl 6079 2017-05-08 09:03:33Z teissa $\n#\n# VLC Media Player Buffer Overflow Vulnerability - July 13 (MAC OS X)\n#\n# Authors:\n# Arun Kallavi <karun@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"\n Impact Level: System/Application\";\n\nif(description)\n{\n script_id(803699);\n script_version(\"$Revision: 6079 $\");\n script_cve_id(\"CVE-2013-1954\");\n script_bugtraq_id(57333);\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-05-08 11:03:33 +0200 (Mon, 08 May 2017) $\");\n script_tag(name:\"creation_date\", value:\"2013-07-16 13:56:02 +0530 (Tue, 16 Jul 2013)\");\n script_name(\"VLC Media Player Buffer Overflow Vulnerability - July 13 (MAC OS X)\");\n\n tag_summary =\n\"This host is installed with VLC Media Player and is prone to\nbuffer overflow vulnerability.\";\n\n tag_insight =\n\"Flaw due to error in 'DemuxPacket()' function in the ASF Demuxer component\n(modules/demux/asf/asf.c) when parsing ASF files.\";\n\n tag_vuldetect =\n\"Get the installed version with the help of detect NVT and check the version\nis vulnerable or not.\";\n\n tag_impact =\n\"Successful exploitation could allow attackers to execute arbitrary code or\ncause denial of service condition in the context of affected application via\ncrafted ASF file.\";\n\n tag_affected =\n\"VLC media player version 2.0.5 and prior on MAC OS X\";\n\n tag_solution =\n\"Upgrade to VLC media player version 2.0.6 or later,\nFor updates refer to http://www.videolan.org/vlc\";\n\n\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"vuldetect\" , value : tag_vuldetect);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name : \"URL\" , value : \"http://secunia.com/advisories/51995\");\n script_xref(name : \"URL\" , value : \"http://www.videolan.org/security/sa1302.html\");\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_vlc_media_player_detect_macosx.nasl\");\n script_mandatory_keys(\"VLC/Media/Player/MacOSX/Version\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\n\n## Variable Initialization\nvlcVer = \"\";\n\n## Get the version from KB\nvlcVer = get_kb_item(\"VLC/Media/Player/MacOSX/Version\");\nif(!vlcVer){\n exit(0);\n}\n\n## Check for VLC Media Player Version <= 2.0.5\nif(version_is_less_equal(version:vlcVer, test_version:\"2.0.5\"))\n{\n security_message(0);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-10-22T16:42:08", "references": ["http://secunia.com/advisories/51995", "http://www.videolan.org/security/sa1302.html", "http://www.videolan.org/vlc"], "pluginID": "1361412562310803698", "description": "This host is installed with VLC Media Player and is prone to\nbuffer overflow vulnerability.", "edition": 6, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "published": "2013-07-16T00:00:00", "title": "VLC Media Player Buffer Overflow Vulnerability - July 13 (Windows)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "General", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1954"], "modified": "2018-10-12T00:00:00", "id": "OPENVAS:1361412562310803698", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310803698", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_bof_vuln_jul13_win.nasl 11865 2018-10-12 10:03:43Z cfischer $\n#\n# VLC Media Player Buffer Overflow Vulnerability - July 13 (Windows)\n#\n# Authors:\n# Arun Kallavi <karun@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:videolan:vlc_media_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.803698\");\n script_version(\"$Revision: 11865 $\");\n script_cve_id(\"CVE-2013-1954\");\n script_bugtraq_id(57333);\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 12:03:43 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-07-16 13:35:48 +0530 (Tue, 16 Jul 2013)\");\n script_name(\"VLC Media Player Buffer Overflow Vulnerability - July 13 (Windows)\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allow attackers to execute arbitrary code or\ncause denial of service condition in the context of affected application via\ncrafted ASF file.\");\n script_tag(name:\"affected\", value:\"VLC media player version 2.0.5 and prior on Windows\");\n script_tag(name:\"insight\", value:\"Flaw due to error in 'DemuxPacket()' function in the ASF Demuxer component\n(modules/demux/asf/asf.c) when parsing ASF files.\");\n script_tag(name:\"solution\", value:\"Upgrade to VLC media player version 2.0.6 or later.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"summary\", value:\"This host is installed with VLC Media Player and is prone to\nbuffer overflow vulnerability.\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/51995\");\n script_xref(name:\"URL\", value:\"http://www.videolan.org/security/sa1302.html\");\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"secpod_vlc_media_player_detect_win.nasl\");\n script_mandatory_keys(\"VLCPlayer/Win/Installed\");\n script_xref(name:\"URL\", value:\"http://www.videolan.org/vlc\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\ninfos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE );\nvers = infos['version'];\npath = infos['location'];\n\nif( version_is_less_equal( version:vers, test_version:\"2.0.5\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"2.0.6\", install_path:path );\n security_message( port:0, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-10-22T16:42:07", "references": ["http://secunia.com/advisories/51995", "http://www.videolan.org/security/sa1302.html", "http://www.videolan.org/vlc"], "pluginID": "1361412562310803699", "description": "This host is installed with VLC Media Player and is prone to\nbuffer overflow vulnerability.", "edition": 6, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "published": "2013-07-16T00:00:00", "title": "VLC Media Player Buffer Overflow Vulnerability - July 13 (MAC OS X)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "General", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1954"], "modified": "2018-10-12T00:00:00", "id": "OPENVAS:1361412562310803699", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310803699", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_bof_vuln_jul13_macosx.nasl 11865 2018-10-12 10:03:43Z cfischer $\n#\n# VLC Media Player Buffer Overflow Vulnerability - July 13 (MAC OS X)\n#\n# Authors:\n# Arun Kallavi <karun@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.803699\");\n script_version(\"$Revision: 11865 $\");\n script_cve_id(\"CVE-2013-1954\");\n script_bugtraq_id(57333);\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 12:03:43 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-07-16 13:56:02 +0530 (Tue, 16 Jul 2013)\");\n script_name(\"VLC Media Player Buffer Overflow Vulnerability - July 13 (MAC OS X)\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allow attackers to execute arbitrary code or cause denial of service condition in the context of affected application via crafted ASF file.\");\n script_tag(name:\"affected\", value:\"VLC media player version 2.0.5 and prior on MAC OS X\");\n script_tag(name:\"insight\", value:\"Flaw due to error in 'DemuxPacket()' function in the ASF Demuxer component\n(modules/demux/asf/asf.c) when parsing ASF files.\");\n script_tag(name:\"solution\", value:\"Upgrade to VLC media player version 2.0.6 or later.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"summary\", value:\"This host is installed with VLC Media Player and is prone to\nbuffer overflow vulnerability.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/51995\");\n script_xref(name:\"URL\", value:\"http://www.videolan.org/security/sa1302.html\");\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_vlc_media_player_detect_macosx.nasl\");\n script_mandatory_keys(\"VLC/Media/Player/MacOSX/Version\");\n script_xref(name:\"URL\", value:\"http://www.videolan.org/vlc\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\n\nvlcVer = get_kb_item(\"VLC/Media/Player/MacOSX/Version\");\nif(!vlcVer){\n exit(0);\n}\n\nif(version_is_less_equal(version:vlcVer, test_version:\"2.0.5\"))\n{\n security_message( port: 0, data: \"The target host was found to be vulnerable\" );\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-10-22T16:41:45", "references": ["http://www.videolan.org/news.html", "http://www.videolan.org/vlc", "http://xforce.iss.net/xforce/xfdb/79823"], "pluginID": "1361412562310803900", "description": "This host is installed with VLC Media Player and is prone to multiple\nvulnerabilities.", "edition": 7, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "published": "2013-07-16T00:00:00", "title": "VLC Media Player Multiple Vulnerabilities - July 13 (Windows)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "General", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1868", "CVE-2012-5855"], "modified": "2018-10-12T00:00:00", "id": "OPENVAS:1361412562310803900", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310803900", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_mult_vuln_jul13_win.nasl 11865 2018-10-12 10:03:43Z cfischer $\n#\n# VLC Media Player Multiple Vulnerabilities - July 13 (Windows)\n#\n# Authors:\n# Arun Kallavi <karun@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:videolan:vlc_media_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.803900\");\n script_version(\"$Revision: 11865 $\");\n script_cve_id(\"CVE-2013-1868\", \"CVE-2012-5855\");\n script_bugtraq_id(57079, 56405);\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 12:03:43 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-07-16 14:24:20 +0530 (Tue, 16 Jul 2013)\");\n script_name(\"VLC Media Player Multiple Vulnerabilities - July 13 (Windows)\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers to overflow buffer, cause denial\nof service or potentially execution of arbitrary code.\");\n script_tag(name:\"affected\", value:\"VLC media player version 2.0.4 and prior on Windows\");\n script_tag(name:\"insight\", value:\"Multiple flaws due to,\n\n - Error in 'SHAddToRecentDocs()' function.\n\n - Error due to improper validation of user supplied inputs when handling\n HTML subtitle files.\");\n script_tag(name:\"solution\", value:\"Upgrade to VLC media player version 2.0.5 or later.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"summary\", value:\"This host is installed with VLC Media Player and is prone to multiple\nvulnerabilities.\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://www.videolan.org/news.html\");\n script_xref(name:\"URL\", value:\"http://xforce.iss.net/xforce/xfdb/79823\");\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"secpod_vlc_media_player_detect_win.nasl\");\n script_mandatory_keys(\"VLCPlayer/Win/Installed\");\n script_xref(name:\"URL\", value:\"http://www.videolan.org/vlc\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\ninfos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE );\nvers = infos['version'];\npath = infos['location'];\n\nif( version_is_less_equal( version:vers, test_version:\"2.0.4\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"2.0.5\", install_path:path );\n security_message( port:0, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-20T13:23:22", "references": ["http://www.videolan.org/news.html", "http://xforce.iss.net/xforce/xfdb/79823"], "pluginID": "803900", "description": "This host is installed with VLC Media Player and is prone to multiple\nvulnerabilities.", "edition": 2, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "published": "2013-07-16T00:00:00", "title": "VLC Media Player Multiple Vulnerabilities - July 13 (Windows)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "General", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1868", "CVE-2012-5855"], "modified": "2017-12-19T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=803900", "id": "OPENVAS:803900", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_mult_vuln_jul13_win.nasl 8174 2017-12-19 12:23:25Z cfischer $\n#\n# VLC Media Player Multiple Vulnerabilities - July 13 (Windows)\n#\n# Authors:\n# Arun Kallavi <karun@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:videolan:vlc_media_player\";\n\nif(description)\n{\n script_id(803900);\n script_version(\"$Revision: 8174 $\");\n script_cve_id(\"CVE-2013-1868\", \"CVE-2012-5855\");\n script_bugtraq_id(57079,56405);\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-19 13:23:25 +0100 (Tue, 19 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2013-07-16 14:24:20 +0530 (Tue, 16 Jul 2013)\");\n script_name(\"VLC Media Player Multiple Vulnerabilities - July 13 (Windows)\");\n\n tag_summary = \"This host is installed with VLC Media Player and is prone to multiple\nvulnerabilities.\";\n\n tag_insight = \"Multiple flaws due to,\n\n - Error in 'SHAddToRecentDocs()' function.\n\n - Error due to improper validation of user supplied inputs when handling\n HTML subtitle files.\";\n\n tag_vuldetect = \"Get the installed version with the help of detect NVT and check the version\nis vulnerable or not.\";\n\n tag_impact = \"Successful exploitation will allow attackers to overflow buffer, cause denial\nof service or potentially execution of arbitrary code.\n\n Impact Level: System/Application\";\n\n tag_affected = \"VLC media player version 2.0.4 and prior on Windows\";\n\n tag_solution = \"Upgrade to VLC media player version 2.0.5 or later,\nFor updates refer to http://www.videolan.org/vlc\";\n\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"vuldetect\" , value : tag_vuldetect);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name : \"URL\" , value : \"http://www.videolan.org/news.html\");\n script_xref(name : \"URL\" , value : \"http://xforce.iss.net/xforce/xfdb/79823\");\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"secpod_vlc_media_player_detect_win.nasl\");\n script_mandatory_keys(\"VLCPlayer/Win/Installed\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\ninfos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE );\nvers = infos['version'];\npath = infos['location'];\n\n## Check for VLC Media Player Version <= 2.0.4\nif( version_is_less_equal( version:vers, test_version:\"2.0.4\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"2.0.5\", install_path:path );\n security_message( port:0, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-02T21:11:15", "references": ["http://www.videolan.org/news.html", "http://xforce.iss.net/xforce/xfdb/79823"], "pluginID": "803901", "description": "This host is installed with VLC Media Player and is prone to multiple\nvulnerabilities.", "edition": 1, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "published": "2013-07-16T00:00:00", "title": "VLC Media Player Multiple Vulnerabilities - July 13 (MAC OS X)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "General", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1868", "CVE-2012-5855"], "modified": "2017-05-12T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=803901", "id": "OPENVAS:803901", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_mult_vuln_jul13_macosx.nasl 6115 2017-05-12 09:03:25Z teissa $\n#\n# VLC Media Player Multiple Vulnerabilities - July 13 (MAC OS X)\n#\n# Authors:\n# Arun Kallavi <karun@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"\n Impact Level: System/Application\";\n\nif(description)\n{\n script_id(803901);\n script_version(\"$Revision: 6115 $\");\n script_cve_id(\"CVE-2013-1868\", \"CVE-2012-5855\");\n script_bugtraq_id(57079,56405);\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-05-12 11:03:25 +0200 (Fri, 12 May 2017) $\");\n script_tag(name:\"creation_date\", value:\"2013-07-16 14:45:11 +0530 (Tue, 16 Jul 2013)\");\n script_name(\"VLC Media Player Multiple Vulnerabilities - July 13 (MAC OS X)\");\n\n tag_summary =\n\"This host is installed with VLC Media Player and is prone to multiple\nvulnerabilities.\";\n\n tag_insight =\n\"Multiple flaws due to,\n - Error in 'SHAddToRecentDocs()' function.\n - Error due to improper validation of user supplied inputs when handling\n HTML subtitle files.\";\n\n tag_vuldetect =\n\"Get the installed version with the help of detect NVT and check the version\nis vulnerable or not.\";\n\n tag_impact =\n\"Successful exploitation will allow attackers to overflow buffer, cause denial\nof service or potentially execution of arbitrary code.\";\n\n tag_affected =\n\"VLC media player version 2.0.4 and prior on MAC OS X\";\n\n tag_solution =\n\"Upgrade to VLC media player version 2.0.5 or later,\nFor updates refer to http://www.videolan.org/vlc\";\n\n\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"vuldetect\" , value : tag_vuldetect);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name : \"URL\" , value : \"http://www.videolan.org/news.html\");\n script_xref(name : \"URL\" , value : \"http://xforce.iss.net/xforce/xfdb/79823\");\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_vlc_media_player_detect_macosx.nasl\");\n script_mandatory_keys(\"VLC/Media/Player/MacOSX/Version\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\n\n## Variable Initialization\nvlcVer = \"\";\n\n## Get the version from KB\nvlcVer = get_kb_item(\"VLC/Media/Player/MacOSX/Version\");\nif(!vlcVer){\n exit(0);\n}\n\n## Check for VLC Media Player Version <= 2.0.4\nif(version_is_less_equal(version:vlcVer, test_version:\"2.0.4\"))\n{\n security_message(0);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "debian": [{"lastseen": "2018-10-18T13:50:12", "references": [], "affectedPackage": [{"OS": "Debian", "OSVersion": "7", "packageVersion": "2.0.3-5+deb7u1", "arch": "all", "packageFilename": "vlc_2.0.3-5+deb7u1_all.deb", "packageName": "vlc", "operator": "lt"}], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2973-1 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nJuly 07, 2014 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : vlc\nCVE ID : CVE-2013-1868 CVE-2013-1954 CVE-2013-4388\n\nMultiple buffer overflows have been found in the VideoLAN media player.\nProcessing malformed subtitles or movie files could lead to denial of\nservice and potentially the execution of arbitrary code.\n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 2.0.3-5+deb7u1.\n\nFor the testing distribution (jessie), these problems have been fixed in\nversion 2.1.0-1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.1.0-1.\n\nWe recommend that you upgrade your vlc packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 2, "reporter": "Debian", "published": "2014-07-07T21:38:33", "title": "[SECURITY] [DSA 2973-1] vlc security update", "type": "debian", "enchantments": {"score": {"modified": "2018-10-18T13:50:12", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2013-1954", "CVE-2013-1868", "CVE-2013-4388"], "modified": "2014-07-07T21:38:33", "id": "DEBIAN:DSA-2973-1:4620E", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2014/msg00154.html", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2018-11-13T17:10:17", "references": ["https://www.debian.org/security/2014/dsa-2973", "https://packages.debian.org/source/wheezy/vlc"], "pluginID": "76417", "description": "Multiple buffer overflows have been found in the VideoLAN media player. Processing malformed subtitles or movie files could lead to denial of service and potentially the execution of arbitrary code.", "edition": 5, "reporter": "Tenable", "published": "2014-07-09T00:00:00", "title": "Debian DSA-2973-1 : vlc - security update", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1954", "CVE-2013-1868", "CVE-2013-4388"], "modified": "2018-11-10T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:vlc", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2973.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=76417", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2973. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(76417);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2018/11/10 11:49:36\");\n\n script_cve_id(\"CVE-2013-1868\", \"CVE-2013-1954\", \"CVE-2013-4388\");\n script_bugtraq_id(57079, 57333, 62724);\n script_xref(name:\"DSA\", value:\"2973\");\n\n script_name(english:\"Debian DSA-2973-1 : vlc - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple buffer overflows have been found in the VideoLAN media\nplayer. Processing malformed subtitles or movie files could lead to\ndenial of service and potentially the execution of arbitrary code.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/vlc\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2014/dsa-2973\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the vlc packages.\n\nFor the stable distribution (wheezy), these problems have been fixed\nin version 2.0.3-5+deb7u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:vlc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"libvlc-dev\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libvlc5\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libvlccore-dev\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libvlccore5\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-data\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-dbg\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-nox\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-plugin-fluidsynth\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-plugin-jack\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-plugin-notify\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-plugin-pulse\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-plugin-sdl\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-plugin-svg\", reference:\"2.0.3-5+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"vlc-plugin-zvbi\", reference:\"2.0.3-5+deb7u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:51:48", "references": ["http://www.videolan.org/developers/vlc-branch/NEWS"], "pluginID": "70560", "description": "The version of VLC media player installed on the remote host is earlier than 2.0.9. It is, therefore, affected by a buffer overflow vulnerability in 'packetizer/mpeg4audio.c'.", "edition": 5, "reporter": "Tenable", "published": "2013-10-23T00:00:00", "title": "VLC < 2.0.9 Buffer Overflow", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Windows", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4388"], "modified": "2018-08-06T00:00:00", "cpe": ["cpe:/a:videolan:vlc_media_player"], "id": "VLC_2_0_9.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=70560", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\n\nif (description)\n{\n script_id(70560);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2018/08/06 14:03:16\");\n\n script_cve_id(\"CVE-2013-4388\");\n script_bugtraq_id(62724);\n\n script_name(english:\"VLC < 2.0.9 Buffer Overflow\");\n script_summary(english:\"Checks version of VLC\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Windows host contains a media player that is affected by a\nbuffer overflow vulnerability.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The version of VLC media player installed on the remote host is earlier\nthan 2.0.9. It is, therefore, affected by a buffer overflow\nvulnerability in 'packetizer/mpeg4audio.c'.\"\n );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.videolan.org/developers/vlc-branch/NEWS\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to VLC version 2.0.9 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/09/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/08/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/23\");\n\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:videolan:vlc_media_player\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"vlc_installed.nasl\");\n script_require_keys(\"SMB/VLC/Version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nvuln_plugins_installed = make_list();\nversion = get_kb_item_or_exit(\"SMB/VLC/Version\");\n\npath = get_kb_item_or_exit(\"SMB/VLC/File\");\npath = ereg_replace(pattern:\"^(.+)\\\\[^\\\\]+$\", replace:\"\\1\", string:path);\n\nport = get_kb_item(\"SMB/transport\");\nif (!port) port = 445;\n\n# nb: 'version' may look like '0.9.8a'!\nif (\n version =~ \"^[01]\\.\" ||\n version =~ \"^2\\.0\\.[0-8]($|[^0-9])\"\n)\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Path : ' + path +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 2.0.9\\n';\n security_warning(port:port, extra:report);\n }\n else security_warning(port);\n exit(0);\n}\nelse audit(AUDIT_INST_PATH_NOT_VULN, \"VLC\", version, path);\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-11-17T03:11:49", "references": ["http://www.videolan.org/vlc/releases/2.0.5.html", "http://www.videolan.org/security/sa1301.html", "http://www.nessus.org/u?4cd2e15e", "https://securitytracker.com/id/1027929"], "pluginID": "63381", "description": "The version of VLC media player installed on the remote host is earlier than 2.0.5. It is, therefore, reportedly affected by the following vulnerabilities :\n\n - An error exists in the file 'modules/codec/subsdec.c' ('libsubsdec_plugin.dll') that does not properly validate input and can allow a buffer overflow. Opening a specially crafted file can result in the execution of arbitrary code. Note that the subtitles feature must be enabled for successful exploitation.\n\n - An error exists related to the 'freetype' renderer that does not properly validate input and can allow a buffer overflow. Opening a specially crafted file can result in the execution of arbitrary code.\n\n - Unspecified errors exist related to 'libaiff_plugin.dll' and to the 'SWF' demuxer that have unspecified impact.", "edition": 6, "reporter": "Tenable", "published": "2013-01-04T00:00:00", "title": "VLC < 2.0.5 Multiple Vulnerabilities", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Windows", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1868"], "modified": "2018-11-15T00:00:00", "cpe": ["cpe:/a:videolan:vlc_media_player"], "id": "VLC_2_0_5.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=63381", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(63381);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2018/11/15 20:50:29\");\n\n script_cve_id(\"CVE-2013-1868\");\n script_bugtraq_id(57079);\n\n script_name(english:\"VLC < 2.0.5 Multiple Vulnerabilities\");\n script_summary(english:\"Checks version of VLC\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Windows host contains a media player that is affected by\nmultiple vulnerabilities.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The version of VLC media player installed on the remote host is earlier\nthan 2.0.5. It is, therefore, reportedly affected by the following\nvulnerabilities :\n\n - An error exists in the file 'modules/codec/subsdec.c'\n ('libsubsdec_plugin.dll') that does not properly\n validate input and can allow a buffer overflow. Opening\n a specially crafted file can result in the execution of\n arbitrary code. Note that the subtitles feature must be\n enabled for successful exploitation.\n\n - An error exists related to the 'freetype' renderer that\n does not properly validate input and can allow a buffer\n overflow. Opening a specially crafted file can result in\n the execution of arbitrary code.\n\n - Unspecified errors exist related to 'libaiff_plugin.dll'\n and to the 'SWF' demuxer that have unspecified impact.\"\n );\n script_set_attribute(attribute:\"see_also\", value:\"https://securitytracker.com/id/1027929\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.videolan.org/security/sa1301.html\");\n # http://git.videolan.org/?p=vlc/vlc-2.0.git;a=commitdiff;h=8e8b02ff1720eb46dabe2864e79d47b40a2792d5\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?4cd2e15e\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.videolan.org/vlc/releases/2.0.5.html\");\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Upgrade to VLC version 2.0.5 or later. Alternatively, remove any\naffected plugin files from VLC's plugins directory.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2012/12/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/12/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/01/04\");\n\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:videolan:vlc_media_player\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"vlc_installed.nasl\");\n script_require_keys(\"SMB/VLC/Version\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nvuln_plugins_installed = make_list();\nversion = get_kb_item_or_exit(\"SMB/VLC/Version\");\n\npath = get_kb_item_or_exit(\"SMB/VLC/File\");\npath = ereg_replace(pattern:\"^(.+)\\\\[^\\\\]+$\", replace:\"\\1\", string:path);\n\n# nb: 'version' may look like '0.9.8a'!\nif (\n version =~ \"^[01]\\.\" ||\n version =~ \"^2\\.0\\.[0-4]($|[^0-9])\"\n) version_is_vulnerable = TRUE;\nelse audit(AUDIT_INST_PATH_NOT_VULN, \"VLC\", version, path);\n\ninstalled_plugins = get_kb_list(\"SMB/VLC/plugin*\");\nif (isnull(installed_plugins)) audit(AUDIT_KB_MISSING, \"SMB/VLC/plugin\");\n\nforeach plugin (installed_plugins)\n if (\n \"\\libsubsdec_plugin.dll\" >< plugin ||\n \"\\libaiff_plugin.dll\" >< plugin\n ) vuln_plugins_installed = make_list(vuln_plugins_installed, plugin);\n\nif (\n # Paranoid scan\n report_paranoia > 1\n ||\n # plugin file check\n max_index(vuln_plugins_installed) > 0\n)\n{\n port = get_kb_item(\"SMB/transport\");\n\n if (report_verbosity > 0)\n {\n report =\n '\\n Path : ' + path +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 2.0.5\\n';\n\n # Add plugin paths if available\n if (max_index(vuln_plugins_installed) > 0)\n {\n report +=\n '\\n - Vulnerable Plugin(s) ';\n\n if (max_index(vuln_plugins_installed) > 1)\n report += 'Paths : ';\n else\n report += 'Path : ';\n\n foreach plugin_path (vuln_plugins_installed)\n report += '\\n ' + plugin_path;\n\n report += '\\n';\n }\n security_hole(port:port, extra:report);\n }\n else security_hole(port);\n exit(0);\n}\nelse exit(0, \"The VLC \"+version+\" install under \"+path+\" does not have the affected plugins.\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:51:10", "references": ["http://trac.videolan.org/vlc/ticket/8024", "http://www.videolan.org/vlc/releases/2.0.6.html", "http://www.nessus.org/u?b8052708", "http://www.videolan.org/security/sa1302.html"], "pluginID": "66216", "description": "The version of VLC media player installed on the remote host is earlier than 2.0.6. It is, therefore, reportedly affected by a buffer overflow vulnerability related to the ASF demuxer plugin.", "edition": 5, "reporter": "Tenable", "published": "2013-04-25T00:00:00", "title": "VLC < 2.0.6 ASF Demuxer Buffer Overflow", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Windows", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1954"], "modified": "2018-08-06T00:00:00", "cpe": ["cpe:/a:videolan:vlc_media_player"], "id": "VLC_2_0_6.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=66216", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\n\nif (description)\n{\n script_id(66216);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2018/08/06 14:03:16\");\n\n script_cve_id(\"CVE-2013-1954\");\n script_bugtraq_id(57333);\n\n script_name(english:\"VLC < 2.0.6 ASF Demuxer Buffer Overflow\");\n script_summary(english:\"Checks version of VLC\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Windows host contains a media player that is affected by a\nbuffer overflow vulnerability.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The version of VLC media player installed on the remote host is earlier\nthan 2.0.6. It is, therefore, reportedly affected by a buffer overflow\nvulnerability related to the ASF demuxer plugin.\"\n );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.videolan.org/security/sa1302.html\");\n # http://git.videolan.org/?p=vlc.git;a=commit;h=b31ce523331aa3a6e620b68cdfe3f161d519631e\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b8052708\");\n script_set_attribute(attribute:\"see_also\", value:\"http://trac.videolan.org/vlc/ticket/8024\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.videolan.org/vlc/releases/2.0.6.html\");\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Upgrade to VLC version 2.0.6 or later. Alternatively, remove the\naffected plugin file from VLC's plugins directory.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/01/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/01/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/04/25\");\n\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:videolan:vlc_media_player\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"vlc_installed.nasl\");\n script_require_keys(\"SMB/VLC/Version\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nvuln_plugins_installed = make_list();\nversion = get_kb_item_or_exit(\"SMB/VLC/Version\");\n\npath = get_kb_item_or_exit(\"SMB/VLC/File\");\npath = ereg_replace(pattern:\"^(.+)\\\\[^\\\\]+$\", replace:\"\\1\", string:path);\n\n# nb: 'version' may look like '0.9.8a'!\nif (\n version =~ \"^[01]\\.\" ||\n version =~ \"^2\\.0\\.[0-5]($|[^0-9])\"\n) version_is_vulnerable = TRUE;\nelse audit(AUDIT_INST_PATH_NOT_VULN, \"VLC\", version, path);\n\ninstalled_plugins = get_kb_list(\"SMB/VLC/plugin*\");\nif (isnull(installed_plugins)) audit(AUDIT_KB_MISSING, \"SMB/VLC/plugin\");\n\nforeach plugin (installed_plugins)\n if (\"\\libasf_plugin.dll\" >< plugin)\n vuln_plugins_installed = make_list(vuln_plugins_installed, plugin);\n\nif (\n # Paranoid scan\n report_paranoia > 1\n ||\n # plugin file check\n max_index(vuln_plugins_installed) > 0\n)\n{\n port = get_kb_item(\"SMB/transport\");\n if (!port) port = 445;\n\n if (report_verbosity > 0)\n {\n report =\n '\\n Path : ' + path +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 2.0.6\\n';\n\n # Add plugin paths if available\n if (max_index(vuln_plugins_installed) > 0)\n {\n report +=\n '\\n - Vulnerable Plugin(s) ';\n\n if (max_index(vuln_plugins_installed) > 1)\n report += 'Paths : ';\n else\n report += 'Path : ';\n\n foreach plugin_path (vuln_plugins_installed)\n report += '\\n ' + plugin_path;\n\n report += '\\n';\n }\n security_hole(port:port, extra:report);\n }\n else security_hole(port);\n exit(0);\n}\nelse exit(0, \"The VLC \"+version+\" install under \"+path+\" does not have the affected plugin.\");\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-02T00:10:40", "references": ["https://security.gentoo.org/glsa/201411-01"], "pluginID": "78879", "description": "The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A remote attacker could entice a user to open a specially crafted media file using VLC, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.\n Workaround :\n\n There is no known workaround at this time.", "edition": 4, "reporter": "Tenable", "published": "2014-11-06T00:00:00", "title": "GLSA-201411-01 : VLC: Multiple vulnerabilities", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-1684", "CVE-2011-0522", "CVE-2012-3377", "CVE-2011-2194", "CVE-2013-1954", "CVE-2010-3124", "CVE-2011-0531", "CVE-2010-1441", "CVE-2012-1775", "CVE-2011-2588", "CVE-2013-1868", "CVE-2010-3275", "CVE-2010-1442", "CVE-2013-6283", "CVE-2011-3623", "CVE-2010-3907", "CVE-2010-2937", "CVE-2011-0021", "CVE-2012-2396", "CVE-2011-1087", "CVE-2013-6934", "CVE-2012-0023", "CVE-2012-5855", "CVE-2012-5470", "CVE-2010-1443", "CVE-2013-4388", "CVE-2012-1776", "CVE-2010-3276", "CVE-2010-1445", "CVE-2013-3245", "CVE-2011-2587", "CVE-2010-1444", "CVE-2010-2062"], "modified": "2016-05-20T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:vlc"], "id": "GENTOO_GLSA-201411-01.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=78879", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201411-01.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(78879);\n script_version(\"$Revision: 1.4 $\");\n script_cvs_date(\"$Date: 2016/05/20 14:03:00 $\");\n\n script_cve_id(\"CVE-2010-1441\", \"CVE-2010-1442\", \"CVE-2010-1443\", \"CVE-2010-1444\", \"CVE-2010-1445\", \"CVE-2010-2062\", \"CVE-2010-2937\", \"CVE-2010-3124\", \"CVE-2010-3275\", \"CVE-2010-3276\", \"CVE-2010-3907\", \"CVE-2011-0021\", \"CVE-2011-0522\", \"CVE-2011-0531\", \"CVE-2011-1087\", \"CVE-2011-1684\", \"CVE-2011-2194\", \"CVE-2011-2587\", \"CVE-2011-2588\", \"CVE-2011-3623\", \"CVE-2012-0023\", \"CVE-2012-1775\", \"CVE-2012-1776\", \"CVE-2012-2396\", \"CVE-2012-3377\", \"CVE-2012-5470\", \"CVE-2012-5855\", \"CVE-2013-1868\", \"CVE-2013-1954\", \"CVE-2013-3245\", \"CVE-2013-4388\", \"CVE-2013-6283\", \"CVE-2013-6934\");\n script_bugtraq_id(42386, 45632, 45927, 46008, 46060, 47012, 47293, 48171, 48664, 51231, 52550, 53391, 53535, 54345, 55850, 57079, 57333, 61032, 61844, 62724, 65139);\n script_xref(name:\"GLSA\", value:\"201411-01\");\n\n script_name(english:\"GLSA-201411-01 : VLC: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201411-01\n(VLC: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in VLC. Please review the\n CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could entice a user to open a specially crafted media\n file using VLC, possibly resulting in execution of arbitrary code with\n the privileges of the process or a Denial of Service condition.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201411-01\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All VLC users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-video/vlc-2.1.2'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'VLC MMS Stream Handling Buffer Overflow');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'White_Phosphorus');\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:vlc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/11/06\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"media-video/vlc\", unaffected:make_list(\"ge 2.1.2\"), vulnerable:make_list(\"lt 2.1.2\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"VLC\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "exploitdb": [{"lastseen": "2016-02-02T20:29:19", "osvdbidlist": ["88299"], "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "references": [], "description": "VLC Media Player 2.0.4 - (.swf) Crash PoC. CVE-2013-1868. Dos exploit for windows platform", "reporter": "coolkaveh", "published": "2012-12-07T00:00:00", "type": "exploitdb", "title": "VLC Media Player 2.0.4 - .swf Crash PoC", "enchantments": {"score": {"vector": "NONE", "value": 10.0}}, "bulletinFamily": "exploit", "cvelist": ["CVE-2013-1868"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "modified": "2012-12-07T00:00:00", "id": "EDB-ID:23201", "href": "https://www.exploit-db.com/exploits/23201/", "sourceData": "Title : VLC media player 2.0.4 buffer overflow POC\r\nVersion : 2.0.4 Twoflower\r\nDate : 2012-12-06\r\nVendor : www.videolan.org/vlc/\r\nImpact : Med/High\r\nContact : coolkaveh [at] rocketmail.com\r\nTwitter : @coolkaveh\r\ntested : windows XP SP3\r\nAuthor : coolkaveh\r\n#####################################################################################################################\r\nVLC media player (also known as VLC) is a highly portable free and open-source media player and streaming \r\nmedia server written by the VideoLAN project. It is a cross-platform media player, with versions for \r\nMicrosoft Windows, OS X, GNU/Linux, Android, BSD, Solaris, iOS, Syllable, BeOS, MorphOS, QNX and eComStation\r\n#####################################################################################################################\r\nBug :\r\n----\r\nbuffer overflow during the handling of the swf file\r\ncontext-dependent\r\nSuccessful exploits can allow attackers to execute arbitrary code\r\n----\r\n######################################################################################################################\r\n(7b4.a14): Access violation - code c0000005 (first chance)\r\nFirst chance exceptions are reported before any exception handling.\r\nThis exception may be expected and handled.\r\neax=75737574 ebx=00e44c20 ecx=7ffd5000 edx=00e44e84 esi=038488c8 edi=000007c0\r\neip=75737574 esp=0196fb5c ebp=00000002 iopl=0 nv up ei pl nz na pe nc\r\ncs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206\r\nMissing image name, possible paged-out or corrupt data.\r\n75737574 ?? ???\r\n0:009>!exploitable -v\r\neax=75737574 ebx=00e44c20 ecx=7ffd5000 edx=00e44e84 esi=038488c8 edi=000007c0\r\neip=75737574 esp=0196fb5c ebp=00000002 iopl=0 nv up ei pl nz na pe nc\r\ncs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206\r\n75737574 ?? ???\r\nHostMachine\\HostUser\r\nExecuting Processor Architecture is x86\r\nDebuggee is in User Mode\r\nDebuggee is a live user mode debugging session on the local machine\r\nEvent Type: Exception\r\n*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - \r\n*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\\Program Files\\VideoLAN\\VLC\\libvlccore.dll - \r\n*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\\Program Files\\VideoLAN\\VLC\\plugins\\codec\\libavcodec_plugin.dll - \r\nException Faulting Address: 0x75737574\r\nFirst Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)\r\nException Sub-Type: Data Execution Protection (DEP) Violation\r\n\r\nException Hash (Major/Minor): 0x307d391a.0x6f0f1537\r\n\r\nStack Trace:\r\nUnknown\r\nlibvlccore!vout_ReleasePicture+0x32\r\nlibavcodec_plugin!vlc_entry_license__1_2_0l+0xe09\r\nlibavcodec_plugin!vlc_entry_license__1_2_0l+0xdf26b\r\nlibavcodec_plugin!vlc_entry_license__1_2_0l+0xdee0e\r\nlibavcodec_plugin!vlc_entry_license__1_2_0l+0xdf37b\r\nntdll!RtlFreeHeap+0x18b\r\nInstruction Address: 0x0000000075737574\r\n\r\nDescription: Data Execution Prevention Violation\r\nShort Description: DEPViolation\r\nExploitability Classification: EXPLOITABLE\r\nRecommended Bug Title: Exploitable - Data Execution Prevention Violation starting at Unknown Symbol @ 0x0000000075737574 called from libvlccore!vout_ReleasePicture+0x0000000000000032 (Hash=0x307d391a.0x6f0f1537)\r\n\r\nUser mode DEP access violations are exploitable.\r\n################################################################################\r\nProof of concept included.\r\n\r\nExploit-DB mirror: http://www39.zippyshare.com/v/91522221/file.html\r\nExploit-DB mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/23201.rar\r\n\r\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/23201/"}], "gentoo": [{"lastseen": "2016-09-06T19:46:06", "references": ["http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1775", "https://bugs.gentoo.org/show_bug.cgi?id=408881", "https://bugs.gentoo.org/show_bug.cgi?id=476436", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2588", "https://bugs.gentoo.org/show_bug.cgi?id=424435", "https://bugs.gentoo.org/show_bug.cgi?id=499806", "https://bugs.gentoo.org/show_bug.cgi?id=352206", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2396", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5470", "https://bugs.gentoo.org/show_bug.cgi?id=316709", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3276", "https://bugs.gentoo.org/show_bug.cgi?id=395543", "https://bugs.gentoo.org/show_bug.cgi?id=350933", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1442", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5855", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1954", "https://bugs.gentoo.org/show_bug.cgi?id=450438", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3377", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1087", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3124", "https://bugs.gentoo.org/show_bug.cgi?id=370321", "https://bugs.gentoo.org/show_bug.cgi?id=332361", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2937", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0021", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1868", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2587", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6283", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2062", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2194", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3907", "https://bugs.gentoo.org/show_bug.cgi?id=442758", "https://bugs.gentoo.org/show_bug.cgi?id=493710", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6934", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3275", "https://bugs.gentoo.org/show_bug.cgi?id=486902", "https://bugs.gentoo.org/show_bug.cgi?id=279340", "https://bugs.gentoo.org/show_bug.cgi?id=353326", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3623", "https://bugs.gentoo.org/show_bug.cgi?id=352776", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0522", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3245", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1443", "https://bugs.gentoo.org/show_bug.cgi?id=454650", "https://bugs.gentoo.org/show_bug.cgi?id=363359", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1445", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0023", "https://bugs.gentoo.org/show_bug.cgi?id=375167", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4388", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1684", "https://bugs.gentoo.org/show_bug.cgi?id=414409", "https://bugs.gentoo.org/show_bug.cgi?id=385953", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1444", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1776", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1441", "https://bugs.gentoo.org/show_bug.cgi?id=285370", "https://bugs.gentoo.org/show_bug.cgi?id=360189", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0531"], "affectedPackage": [{"OS": "Gentoo", "OSVersion": "any", "packageVersion": "2.1.2", "packageName": "media-video/vlc", "packageFilename": "UNKNOWN", "arch": "all", "operator": "lt"}], "description": "### Background\n\nVLC is a cross-platform media player and streaming server.\n\n### Description\n\nMultiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could entice a user to open a specially crafted media file using VLC, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll VLC users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-video/vlc-2.1.2\"", "edition": 1, "reporter": "Gentoo Foundation", "published": "2014-11-05T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "type": "gentoo", "title": "VLC: Multiple vulnerabilities", "bulletinFamily": "unix", "cvelist": ["CVE-2011-1684", "CVE-2011-0522", "CVE-2012-3377", "CVE-2011-2194", "CVE-2013-1954", "CVE-2010-3124", "CVE-2011-0531", "CVE-2010-1441", "CVE-2012-1775", "CVE-2011-2588", "CVE-2013-1868", "CVE-2010-3275", "CVE-2010-1442", "CVE-2013-6283", "CVE-2011-3623", "CVE-2010-3907", "CVE-2010-2937", "CVE-2011-0021", "CVE-2012-2396", "CVE-2011-1087", "CVE-2013-6934", "CVE-2012-0023", "CVE-2012-5855", "CVE-2012-5470", "CVE-2010-1443", "CVE-2013-4388", "CVE-2012-1776", "CVE-2010-3276", "CVE-2010-1445", "CVE-2013-3245", "CVE-2011-2587", "CVE-2010-1444", "CVE-2010-2062"], "modified": "2014-11-05T00:00:00", "id": "GLSA-201411-01", "href": "https://security.gentoo.org/glsa/201411-01", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}