CVE-2008-1489 Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box...
MediumCVSS 6.8
EPSS 11.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box that triggers a heap-based buffer overflow, a different vulnerability than CVE-2008-0984.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| videolan vlc | = 0.8.6e | No fix listed |
| debian/vlc(Debian:12) | < 0.8.6.e-1.1 | 0.8.6.e-1.1 |
| debian/vlc(Debian:13) | < 0.8.6.e-1.1 | 0.8.6.e-1.1 |
| debian/vlc(Debian:14) | < 0.8.6.e-1.1 | 0.8.6.e-1.1 |
References
- 29503 third-party-advisory
- 29766 third-party-advisory
- 29800 third-party-advisory
- GLSA-200804-25 vendor-advisory
- trac.videolan.org exploit
- wiki.videolan.org
- DSA-1543 vendor-advisory
- 28433 vdb-entry
- www.videolan.org
- ADV-2008-0985 vdb-entry
- vlcmediaplayer-mp4readbox-rdrf-bo(41412) vdb-entry
- oval:org.mitre.oval:def:14841 signature vdb-entry
- Debian Security Tracker CVE-2008-1489 vendor-advisory
- bugs.debian.org issue-tracking