Vlc Media Player Security Vulnerabilities and Issues — Vlc Media Player CVE List

Lucene search

VideolanVlc Media Player

28 matches found

CVE•added 2019/06/18 6:15 p.m.•223 views

CVE-2019-12874

An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.

9.8CVSS8AI score0.02534EPSS

CVE•added 2019/07/18 8:15 p.m.•221 views

CVE-2019-13962

lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

9.8CVSS9.3AI score0.0194EPSS

CVE•added 2018/12/05 11:29 a.m.•170 views

CVE-2018-19857

The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial...

9.1CVSS7.9AI score0.01574EPSS

CVE•added 2023/11/07 4:15 p.m.•140 views

CVE-2023-47359

Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memory corruption.

9.8CVSS9.1AI score0.00126EPSS

CVE•added 2011/02/07 9:0 p.m.•132 views

CVE-2011-0531

demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary commands via a crafted MKV (WebM or Matroska) file that triggers memory corruption, related to "class mismatching" and the ...

9.3CVSS7.3AI score0.73766EPSS

CVE•added 2012/03/19 4:55 p.m.•131 views

CVE-2012-1775

Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream.

9.3CVSS7.8AI score0.62287EPSS

CVE•added 2017/06/30 1:29 p.m.•108 views

CVE-2017-10699

avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution.

9.8CVSS9.5AI score0.00822EPSS

CVE•added 2007/06/21 6:30 p.m.•77 views

CVE-2007-3316

Multiple format string vulnerabilities in plugins in VideoLAN VLC Media Player before 0.8.6c allow remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in (1) an Ogg/Vorbis file, (2) an Ogg/Theora file, (3) a CDDB entry for a CD Digital Audio ...

9.3CVSS7.6AI score0.46189EPSS

CVE•added 2008/11/10 4:15 p.m.•67 views

CVE-2008-5032

Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. NOTE: this identifier originally included an issue related to RealText, but ...

9.3CVSS7.5AI score0.69531EPSS

CVE•added 2016/06/08 3:0 p.m.•66 views

CVE-2016-5108

Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.

9.8CVSS9.6AI score0.26953EPSS

CVE•added 2008/02/26 7:44 p.m.•64 views

CVE-2008-0984

The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.

9.3CVSS7.2AI score0.26592EPSS

CVE•added 2011/03/28 4:55 p.m.•64 views

CVE-2010-3275

libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file, related to a "dangling pointer vulnerability."

9.3CVSS7.4AI score0.86659EPSS

CVE•added 2011/06/24 8:55 p.m.•62 views

CVE-2011-2194

Integer overflow in the XSPF playlist parser in VideoLAN VLC media player 0.8.5 through 1.1.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a heap-based buffer overflow.

9.3CVSS8AI score0.31365EPSS

CVE•added 2013/07/10 7:55 p.m.•59 views

CVE-2013-1868

Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.

9.3CVSS7.5AI score0.50657EPSS

CVE•added 2008/07/07 11:41 p.m.•56 views

CVE-2008-2430

Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.

9.3CVSS7.5AI score0.0843EPSS

CVE•added 2008/10/22 12:11 a.m.•56 views

CVE-2008-4654

Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.

9.3CVSS7.6AI score0.81203EPSS

CVE•added 2008/10/22 6:0 p.m.•55 views

CVE-2008-4686

Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.

9.3CVSS7.2AI score0.81203EPSS

CVE•added 2008/11/10 10:18 p.m.•55 views

CVE-2008-5036

Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT from CVE-2008-5032 o...

9.3CVSS7.6AI score0.69531EPSS

CVE•added 2008/12/03 5:30 p.m.•55 views

CVE-2008-5276

Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.

9.3CVSS7.6AI score0.12455EPSS

CVE•added 2010/08/26 6:36 p.m.•54 views

CVE-2010-3124

Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.

9.3CVSS7.4AI score0.08392EPSS

CVE•added 2010/01/21 8:30 p.m.•48 views

CVE-2010-0364

Stack-based buffer overflow in VideoLAN VLC Media Player 0.8.6 allows user-assisted remote attackers to execute arbitrary code via an ogg file with a crafted Advanced SubStation Alpha Subtitle (.ass) file, probably involving the Dialogue field.

9.3CVSS8AI score0.06665EPSS

CVE•added 2012/10/30 7:55 p.m.•48 views

CVE-2012-0023

Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.

9.3CVSS7.5AI score0.09189EPSS

CVE•added 2011/03/28 4:55 p.m.•47 views

CVE-2010-3276

libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.

9.3CVSS7.4AI score0.06488EPSS

CVE•added 2011/01/25 7:0 p.m.•46 views

CVE-2011-0021

Multiple heap-based buffer overflows in cdg.c in the CDG decoder in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted CDG video.

9.3CVSS7.9AI score0.0808EPSS

CVE•added 2008/08/20 4:41 p.m.•45 views

CVE-2008-3732

Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TTA file, which triggers a heap-based buffer overflow. NOTE: some of these details are ob...

9.3CVSS8AI score0.2514EPSS

CVE•added 2012/03/19 4:55 p.m.•44 views

CVE-2012-1776

Multiple heap-based buffer overflows in VideoLAN VLC media player before 2.0.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real RTSP stream.

9.3CVSS7.9AI score0.04148EPSS

CVE•added 2009/07/16 4:30 p.m.•43 views

CVE-2009-2484

Stack-based buffer overflow in the Win32AddConnection function in modules/access/smb.c in VideoLAN VLC media player 0.9.9, when running on Microsoft Windows, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long smb URI in a playlist...

9.3CVSS8AI score0.68591EPSS

CVE•added 2011/01/03 8:0 p.m.•42 views

CVE-2010-3907

Multiple integer overflows in real.c in the Real demuxer plugin in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a zero i_subpackets value in a Real Media file, leading to a heap-based buffer ove...

9.3CVSS8.1AI score0.04354EPSS