CVE-2018-6157

Type confusion in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

CVE-2018-6132

Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file...

CVE-2018-6156

CVE-2018-6156 affects Google Chrome/WebRTC: an incorrect derivation of a packet length in WebRTC can cause a heap-based buffer overflow, enabling potential remote arbitrary code execution via a crafted video file. The security notes in connected docs indicate the fix was applied in chrome-related...

CVE-2018-6155

Incorrect handling of frames in the VP8 parser in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

CVE-2018-6155

CVE-2018-6155 is a use-after-free in the VP8 handling path (libvpx) used by WebRTC/video processing. Exploitation could arise from processing crafted VP8 frames, potentially affecting Chrome/WebRTC users prior to version 68.0.3440.75. The vulnerability is rooted in VP8 parsing/processing (frames ...

CVE-2018-6156

Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

CVE-2018-6157

CVE-2018-6157 is a type-confusion vulnerability in WebRTC within Google Chrome (pre-68.0.3440.75). A crafted video packet can cause the H264 parser to mis-handle data, leading to potential heap corruption. Affected product: Google Chrome/WebRTC; impact described as heap corruption via crafted vid...

CVE-2018-6156

Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

CVE-2018-6155

Removed by vendor...

CVE-2018-6157

Removed by vendor...

CVE-2018-6132

Removed by vendor...

Beware! Playing Untrusted Videos On VLC Player Could Hack Your Computer

If you use VLC media player on your computer and haven't updated it recently, don't you even dare to play any untrusted, randomly downloaded video file on it. Doing so could allow hackers to remotely take full control over your computer system. That's because VLC media player software versions...

CVE-2019-9718

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ffhtmlmarkuptoass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf...

chromium-browser: Uninitialized value in media reader

Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file...

Denial Of Service (DoS)

mozilla firefox is vulnerable to heap-based buffer overflow vulnerability. This can be triggered using a malformed video file due to incorrect error handling. A remote attacker can execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin GMP sandbox bypass...

CARBANAK Week Part Four: The CARBANAK Desktop Video Player

Part One, Part Two and Part Three of CARBANAK Week are behind us. In this final blog post, we dive into one of the more interesting tools that is part of the CARBANAK toolset. The CARBANAK authors wrote their own video player and we happened to come across an interesting video capture from CARBAN...

CVE-2019-5818

Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file...

Format string

A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handleopenbrace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf...

Format string

In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ffhtmlmarkuptoass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf...

CVE-2019-9721

A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handleopenbrace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf...