CVE-2007-6262 A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget, (2) getVariable, or (3) setVari...
MediumCVSS 6.8
EPSS 11.1%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget, (2) getVariable, or (3) setVariable function, resulting from a "bad initialized pointer," aka a "recursive plugin release vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| videolan vlc media player | = 0.8.6 | No fix listed |
| videolan vlc media player | = 0.8.6a | No fix listed |
| videolan vlc media player | = 0.8.6b | No fix listed |
References
- 27878 third-party-advisory vendor-advisory
- 3420 third-party-advisory
- www.coresecurity.com
- 20071204 CORE-2007-1004: VLC Activex Bad Pointer Initialization Vulnerability mailing-list
- 26675 exploit patch vdb-entry
- www.videolan.org
- ADV-2007-4061 vdb-entry
- vlcmediaplayer-activex-memory-overwrite(38816) vdb-entry
- oval:org.mitre.oval:def:14280 signature vdb-entry
- Debian Security Tracker CVE-2007-6262 vendor-advisory