Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple buffer overflows have been found in the VideoLAN media player. Processing malformed subtitles or movie files could lead to denial of service and potentially the execution of arbitrary code.

The remote host contains VLC player, a multi-media application.

Versions of VLC media player earlier than 2.0.5 are potentially affected by the following vulnerabilities :

  - An error exists in the file 'modules/codec/subsdec.c' ('libsubsdec_plugin.dll') that does not properly validate input and can allow a buffer overflow. Opening a specially crafted file can result in the execution of arbitrary code. Note that the subtitles feature must be enabled for successful exploitation.

  - An error exists related to the 'freetype' renderer that does not properly validate input and can allow a buffer overflow. Opening a specially crafted file can result in the execution of arbitrary code.

  - Unspecified errors exist related to 'libaiff_plugin.dll' and to the 'SWF' demuxer that have unspecified impact.

The remote host is running VLC 2.x prior to 2.0.5 and is affected by multiple vulnerabilities :

  - An error exists in the file 'modules/codec/subsdec.c' ('libsubsdec_plugin.dll') that does not properly validate input and can allow a buffer overflow. Opening a specially crafted file can result in the execution of arbitrary code. Note that the subtitles feature must be enabled for successful exploitation.
 - An error exists related to the 'freetype' renderer that does not properly validate input and can allow a buffer overflow. Opening a specially crafted file can result in the execution of arbitrary code.
 - Unspecified errors exist related to 'libaiff_plugin.dll' and to the 'SWF' demuxer that have unspecified impact.

The version of VLC media player installed on the remote Windows host is prior to 2.0.5. It is, therefore, affected by multiple vulnerabilities:

  - An exploitable denial of service vulnerability exists in the SHAddToRecentDocs function in VideoLAN VLC     media player before 2.0.5. Allow user-assisted attackers to cause a denial of service (crash) via a     crafted file name that triggers an incorrect string-length calculation when the file is added to VLC.     (CVE-2012-5855).

  - Multiple buffer overflows in VideoLAN VLC media player before 2.0.5. Allow remote attackers to cause a     denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer     and (2) HTML subtitle parser. (CVE-2013-1868).
 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
76417	Debian DSA-2973-1 : vlc - security update	Nessus	Debian Local Security Checks	high
801175	VLC Media Player < 2.0.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6658	VLC Media Player < 2.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
63381	VLC < 2.0.5 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2013-1868

high

Tenable Plugins

high

high

high

high

critical