CVE-2008-4558 Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a si...
MediumCVSS 6.8
EPSS 8.5%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a signed comparison.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| videolan vlc media player | = 0.9.2 | No fix listed |
| debian/vlc(Debian:12) | < 0.9.3-1 | 0.9.3-1 |
| debian/vlc(Debian:13) | < 0.9.3-1 | 0.9.3-1 |
| debian/vlc(Debian:14) | < 0.9.3-1 | 0.9.3-1 |
References
- 32267 third-party-advisory vendor-advisory
- www.coresecurity.com exploit
- 6756 exploit
- 20081014 CORE-2008-1010: VLC media player XSPF Memory Corruption mailing-list
- 31758 vdb-entry
- ADV-2008-2826 vdb-entry
- vlc-parsetracknode-code-execution(45869) vdb-entry
- oval:org.mitre.oval:def:14726 signature vdb-entry
- Debian Security Tracker CVE-2008-4558 vendor-advisory
- bugs.debian.org issue-tracking