Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element with infinite size" followed by another element of an upper level in an EBML document.

Mortiz Bunkus reports :

Multiple invalid memory accesses vulnerabilities.

The remote host is running VLC 2.x prior to 2.0.2 and is affected by multiple vulnerabilities :

 - An invalid pointer dereference flaw exists in the 3GP file format parser. With a specially crafted 3GP file, a context-dependent attacker can potentially execute arbitrary code.
 - The libpng library used by VLC contains an out-of-bounds read flaw in the 'png_convert_to_rfc1123()' function in 'png.c' that may allow a context-dependent attacker to crash an application linked against the library or disclose memory contents.
 - The libEBML library used by VLC contains a use-after-free error in the 'EblMaster::Read()' function in 'EbmlMaster.cpp' that is triggered when handling deeply nested elements with an infinite size. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - The libEBML library used by VLC contains an out-of-bounds read condition in the 'UTFstring::UpdateFromUTF8()' function in 'EbmlUnicodeString.cpp' that is triggered when reading UTF-8 strings. This may allow a context-dependent attacker to crash an application linked against the library or potentially disclose memory contents.
 - The libpng library contains overflow conditions in the 'png_set_PLTE()' function in 'pngset.c' and 'png_get_PLTE()' function in 'pngget.c' that are triggered when handling bit depths less than 8. With a specially crafted PNG image, a context-dependent attacker can cause a buffer overflow, crashing an application linked against the library or potentially execute arbtirary code.
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the web interface does not validate files' title metadata before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - A flaw exists that is triggered as user-supplied input is not properly validated when handling a specially crafted MP4 file. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified double-free flaw exists in the ADPCM decoder, which may allow an attacker to have an unspecified impact.
 - Multiple unspecified double-frees, integer overflows, infinite loops, read overflows, invalid frees, and division-by-zero flaws exist. No further details have been provided by the vendor.
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the HTTP interface does not validate input before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - An off-by-one overflow condition exists in the RealRtsp module. The issue is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact.

Several vulnerabilities were discovered in libebml, a library for manipulating Extensible Binary Meta Language files.

  - CVE-2015-8789     Context-dependent attackers could trigger a     use-after-free vulnerability by providing a maliciously     crafted EBML document.

  - CVE-2015-8790     Context-dependent attackers could obtain sensitive     information from the process' heap memory by using a     maliciously crafted UTF-8 string.

  - CVE-2015-8791     Context-dependent attackers could obtain sensitive     information from the process' heap memory by using a     maliciously crafted length value in an EBML id.

ID	Name	Product	Family	Severity
96993	FreeBSD : libebml -- multiple vulnerabilities (a130bd8c-eafe-11e6-9ac1-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	critical
9267	VLC Media Player < 2.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
90281	Debian DSA-3538-1 : libebml - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2015-8789

critical

Tenable Plugins

critical

critical

critical