Heap-based buffer overflow in the AVI_ChunkRead_strf function in libavi.c in the AVI demuxer in VideoLAN VLC media player before 1.1.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted AVI media file.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host contains VLC player, a multi-media application.

Versions of VLC media player earlier than 1.1.11 are potentially affected by multiple vulnerabilities : 

  - A buffer overflow vulnerability exists in the Read Media file parser. (SA-1105)

  - A heap overflow vulnerability exists in the AVI file parser. (SA-1106)

The remote host contains VLC player, a multi-media application. 

Versions of VLC media player earlier than 1.1.11 are potentially affected by multiple vulnerabilities : 

  - A buffer overflow vulnerability exists in the Read Media file parser. (SA-1105)

  - A heap overflow vulnerability exists in the AVI file parser. (SA-1106)

The version of VLC media player installed on the remote host is between 0.5.0 and 1.1.10.  As such, it is reportedly affected by multiple vulnerabilities:

  - An integer overflow error exists in the handling of     the RealAudio portions of RealMedia files.     (VideoLAN-SA-1105)

  - An integer underflow error exists in the handling of     'strf' portions of AVI files. (VideoLAN-SA-1106)

Exploiting these vulnerabilities can lead to application crashes and possibly code execution through heap-based buffer overflows.

ID	Name	Product	Family	Severity
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
801177	VLC Media Player > 0.5.0 and < 1.1.11 Multiple Code Execution Vulnerabilities	Log Correlation Engine	Web Clients	high
5987	VLC Media Player > 0.5.0 and < 1.1.11 Multiple Code Execution Vulnerabilities	Nessus Network Monitor	Web Clients	high
55608	VLC Media Player 0.5.0 to 1.1.10 Multiple Buffer Overflows	Nessus	Windows	high

Detections

Analytics

CVE-2011-2588

high

Tenable Plugins

high

high

high

high