Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of VLC media player installed on the remote host is earlier than 1.1.9.  Such versions are affected by multiple vulnerabilities:

  - A heap based buffer overflow exists in the function     'MP4_ReadBox_skcr' in 'modules/demux/mp4/libmp4.c'.
    This issue can be triggered when parsing of a     malicious MP4 file and lead to application crashes and     possibly arbitrary code execution.

  - An unspecified error exists in the third-party     libmodplug component included with VLC.

Aliz Hammond discovered that the MP4 decoder plugin of VLC, a multimedia player and streamer, is vulnerable to a heap-based buffer overflow. This has been introduced by a wrong data type being used for a size calculation. An attacker could use this flaw to trick a victim into opening a specially crafted MP4 file and possibly execute arbitrary code or crash the media player.

The oldstable distribution (lenny) is not affected by this problem.

The remote host contains VLC player, a multi-media application.

Versions of VLC media player earlier than 1.1.9 are potentially affected by heap corruption vulnerability in the MP4 demultiplexer which could lead to arbitrary code execution.

The remote host contains VLC player, a multi-media application.  

Versions of VLC media player earlier than 1.1.9 are potentially affected by heap corruption vulnerability in the MP4 demultiplexer which could lead to arbitrary code execution.

ID	Name	Product	Family	Severity
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53405	VLC Media Player < 1.1.9 Multiple Vulnerabilities	Nessus	Windows	high
53393	Debian DSA-2218-1 : vlc - heap-based buffer overflow	Nessus	Debian Local Security Checks	medium
801170	VLC Media Player < 1.1.9 Heap Corruption Vulnerability	Log Correlation Engine	Web Clients	high
5883	VLC Media Player < 1.1.9 Heap Corruption Vulnerability (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2011-1684

high

Tenable Plugins

high

high

medium

high

high