CVE-2008-4686 Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty....
HighCVSS 9.3
EPSS 9.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| videolan vlc media player | = 0.9.0 | No fix listed |
| videolan vlc media player | = 0.9.1 | No fix listed |
| videolan vlc media player | = 0.9.2 | No fix listed |
| videolan vlc media player | = 0.9.3 | No fix listed |
| videolan vlc media player | = 0.9.4 | No fix listed |
| debian/vlc(Debian:12) | < 0.8.6.h-4.1 | 0.8.6.h-4.1 |
| debian/vlc(Debian:13) | < 0.8.6.h-4.1 | 0.8.6.h-4.1 |
| debian/vlc(Debian:14) | < 0.8.6.h-4.1 | 0.8.6.h-4.1 |
References
- git.videolan.org
- [oss-security] 20081019 CVE id request: vlc mailing-list
- [oss-security] 20081022 Re: CVE id request: vlc mailing-list
- 31867 vdb-entry
- oval:org.mitre.oval:def:14630 signature vdb-entry
- Debian Security Tracker CVE-2008-4686 vendor-advisory
- bugs.debian.org issue-tracking