The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly process ID3v2 tags, which allows remote attackers to cause a denial of service (application crash) via a crafted media file.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

VideoLAN project reports :

VLC fails to perform sufficient input validation when trying to extract some meta-informations about input media through ID3v2 tags.
In the failure case, VLC attempt dereference an invalid memory address, and a crash will ensure.

ID	Name	Product	Family	Severity
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
48334	FreeBSD : vlc -- invalid id3v2 tags may lead to invalid memory dereferencing (e7d91a3c-a7c9-11df-870c-00242b513d7c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-2937

medium

Tenable Plugins

high

medium