VideoLAN VLC media player 2.0.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted MP4 file.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Specially crafted MP4 files could crash taglib

Updated taglib packages fix security vulnerabilities :

taglib before 1.7.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted MP4 file (CVE-2012-2396).

The version of VLC media player installed on the remote host is prior to 2.0.2. It is, therefore, affected by the following vulnerabilities :

  - A denial of service (DoS) vulnerability exists in libpng_plugin in VLC media player before 2.0.2. Allows     remote attackers to cause a denial of service (crash) via a crafted PNG file. (CVE-2012-2396)

  - A denial of service (DoS) vulnerability exists in the Ogg_DecodePacket function in the OGG demuxer     (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 . Allows remote attackers to cause a     denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.     (CVE-2012-3377)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
74625	openSUSE Security Update : taglib (openSUSE-SU-2012:0615-1)	Nessus	SuSE Local Security Checks	medium
66143	Mandriva Linux Security Advisory : taglib (MDVSA-2013:131)	Nessus	Mandriva Local Security Checks	medium
60049	VLC Media Player < 2.0.2 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2012-2396

medium

Tenable Plugins

high

medium

medium

medium