demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary commands via a crafted MKV (WebM or Matroska) file that triggers memory corruption, related to "class mismatching" and the MKV_IS_ID macro.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Dan Rosenberg discovered that insufficient input validation in VLC's processing of Matroska/WebM containers could lead to the execution of arbitrary code.

The remote host contains VLC player, a multi-media application.

Versions of VLC media player earlier than 1.1.7 are potentially affected by a code execution vulnerability due to insufficient input validation when parsing a specially crafted Matroska or WebM (MKV) file.

The remote host contains VLC player, a multi-media application. 

Versions of VLC media player earlier than 1.1.7 are potentially affected by a code execution vulnerability due to insufficient input validation when parsing a specially crafted Matroska or WebM (MKV) file.

The version of VLC media player installed on the remote host is earlier than 1.1.7.  Such versions are reportedly affected by the following vulnerability :

  - Insufficient input validation when parsing a specially     crafted Matroska or WebM (MKV) file can be exploited to     execute arbitrary code.

ID	Name	Product	Family	Severity
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
51946	Debian DSA-2159-1 : vlc - missing input sanitising	Nessus	Debian Local Security Checks	high
801173	VLC Media Player < 1.1.7 Code Execution Vulnerability	Log Correlation Engine	Web Clients	high
5756	VLC Media Player < 1.1.7 Code Execution Vulnerability (deprecated)	Nessus Network Monitor	Web Clients	high
51851	VLC Media Player < 1.1.7 MKV Input Validation Vulnerability	Nessus	Windows	high

Detections

Analytics

CVE-2011-0531

high

Tenable Plugins

high

high

high

high

high