Heap-based buffer overflow in the Ogg_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host contains VLC player, a multi-media application.

Versions of VLC media player earlier than 2.0.2 are potentially affected by a heap-based buffer overflow vulnerability. An error exists in the function 'Ogg_DecodePacket' in the file 'modules/demux/ogg.c' that does not properly validate input and can allow a heap-based buffer overflow. Opening a specially crafted file can result in the execution of arbitrary code. (CVE-2012-3377)

The remote host is running VLC 2.x prior to 2.0.2 and is affected by a heap-based buffer overflow vulnerability. An error exists in the function 'Ogg_DecodePacket' in the file 'modules/demux/ogg.c' that does not properly validate input and can allow a heap-based buffer overflow. Opening a specially crafted file can result in the execution of arbitrary code.

The version of VLC media player installed on the remote host is prior to 2.0.2. It is, therefore, affected by the following vulnerabilities :

  - A denial of service (DoS) vulnerability exists in libpng_plugin in VLC media player before 2.0.2. Allows     remote attackers to cause a denial of service (crash) via a crafted PNG file. (CVE-2012-2396)

  - A denial of service (DoS) vulnerability exists in the Ogg_DecodePacket function in the OGG demuxer     (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 . Allows remote attackers to cause a     denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.     (CVE-2012-3377)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
801179	VLC Media Player < 2.0.2 Ogg_DecodePacket Function OGG File Handling Overflow	Log Correlation Engine	Web Clients	high
6518	VLC Media Player < 2.0.2 RCE	Nessus Network Monitor	Web Clients	high
60049	VLC Media Player < 2.0.2 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2012-3377

high

Tenable Plugins

high

high

high

medium