CVE-2008-2430 Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.
HighCVSS 9.3
EPSS 5.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| videolan vlc media player | = 0.8.6h | No fix listed |
| debian/vlc(Debian:12) | < 0.8.6.h-1 | 0.8.6.h-1 |
| debian/vlc(Debian:13) | < 0.8.6.h-1 | 0.8.6.h-1 |
| debian/vlc(Debian:14) | < 0.8.6.h-1 | 0.8.6.h-1 |
References
- 30601 third-party-advisory vendor-advisory
- 31317 third-party-advisory
- secunia.com vendor-advisory
- GLSA-200807-13 vendor-advisory
- 3976 third-party-advisory
- 20080702 Secunia Research: VLC Media Player WAV Processing Integer Overflow mailing-list
- 30058 vdb-entry
- 1020429 vdb-entry
- www.videolan.org
- ADV-2008-1995 vdb-entry
- oval:org.mitre.oval:def:14344 signature vdb-entry
- oval:org.mitre.oval:def:14769 signature vdb-entry
- Debian Security Tracker CVE-2008-2430 vendor-advisory
- bugs.debian.org issue-tracking